Configure Security Policies GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which GitLab security policy type is used to require approvals or block merge requests based on the results of security scans?

   • AScan result policy
   • BMerge request approval policy
   • CVulnerability management policy
   • DPipeline execution policy
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   A security team is explaining to developers how security policies enforce requirements. A developer asks: 'If a policy is defined at the group level, does it apply to all projects in the group, even if a project has its own policy?' What is the correct answer?

   • AYes, group-level policies apply to all projects in the group, and project-level policies are evaluated in addition to them.
   • BNo, group-level policies only apply to projects that explicitly opt in to the policy.
   • CYes, but only if the project does not have its own policy; otherwise the project policy takes precedence.
   • DNo, project-level policies always override group-level policies, so the group policy is ignored.
   Reveal Solution Discussion Select an answer first
4. 3application · easy

   A security policy was created to block merge requests when a high-severity dependency vulnerability is found. After a false positive was reported, the team wants to temporarily stop the policy from blocking merges while they investigate, but they want to keep the policy configuration intact for later re-enabling. What should they do?

   • ADisable the policy in the policy settings, then re-enable it after the investigation is complete.
   • BRemove the rule from the policy and add it back later.
   • CEdit the policy to change the action from 'block_merge' to 'require_approval'.
   • DDelete the policy and recreate it from scratch after the investigation.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Where can a GitLab administrator review audit events related to security policy changes?

   • AIn the project's issue tracker
   • BIn the Audit Events section of the admin area or group/project
   • CIn the merge request description
   • DIn the CI/CD pipeline logs
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A merge request approval policy requires two approvals from the 'backend-owners' group. A developer who is a member of 'backend-owners' approves the merge request. Another developer from the same group also approves it. The merge request now shows two approvals. Will the policy be satisfied?

   • ANo, because the approvals must come from two different groups, not the same group.
   • BYes, but only if the approvals are from different members of the group, which they are.
   • CYes, because both approvals are from members of the required group, and the policy counts them.
   • DNo, because the developer who created the merge request cannot approve it.
   Reveal Solution Discussion Select an answer first