A team wants to ensure that all new critical vulnerabilities are reviewed by a security engineer before a merge request is merged. They have dependency scanning enabled. What should they configure?

Set `DS_MAJOR_VERSION: "4"` to ensure the latest analyzers are used.

Configure the project's 'Merge request approvals' to require approval from the security team for all merge requests.

Enable 'Security Approvals' and add a rule that requires approval from a security engineer for critical vulnerabilities.

Add a manual job to the pipeline that checks the vulnerability report and fails if any critical finding exists.

A company has a monorepo containing a Python application and a Node.js application. They want to scan both with dependency scanning. What should they do?

Configure `DS_EXCLUDED_ANALYZERS` to include both `gemnasium-python` and `gemnasium-nodejs`.

Create two separate projects, one for each application, and enable dependency scanning in each.

Manually specify the language in the `DS_ANALYZER_IMAGE_PREFIX` variable.

Enable dependency scanning; GitLab automatically detects and scans both Python and Node.js dependencies.

How can dependency scanning findings be integrated with merge request approvals?

By setting the `DS_APPROVAL_REQUIRED` variable to true

By configuring security approval policies that require approval when vulnerabilities are found

By adding a manual approval step in the CI/CD pipeline

By enabling the 'Dependency Scanning Approvals' toggle in project settings

GitLabCertified Security Associate

Domain 2Objective 2

Configure Dependency Scanning GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 4)

Part of the Secret and Dependency Scanning domain, which makes up ~21% of our current practice bank.

19questions here

4free pages

6concepts

Questions 16–19

16application · medium
A team wants to ensure that all new critical vulnerabilities are reviewed by a security engineer before a merge request is merged. They have dependency scanning enabled. What should they configure?
Select an answer first
17application · easy
A company has a monorepo containing a Python application and a Node.js application. They want to scan both with dependency scanning. What should they do?
Select an answer first
18foundation · easy
How can dependency scanning findings be integrated with merge request approvals?
Select an answer first
19foundation · easy
Which Auto DevOps feature automatically includes dependency scanning?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.

Configure Dependency Scanning GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 4)

Questions 16–19

A team wants to ensure that all new critical vulnerabilities are reviewed by a security engineer before a merge request is merged. They have dependency scanning enabled. What should they configure?

A company has a monorepo containing a Python application and a Node.js application. They want to scan both with dependency scanning. What should they do?

How can dependency scanning findings be integrated with merge request approvals?

Which Auto DevOps feature automatically includes dependency scanning?

Keep studying — Secret and Dependency Scanning