A security analyst needs to identify which projects in a group have dependencies with a license that is on the company's deny list. They want a quick overview without opening each project individually. What should they use?

The group's License Compliance page, which shows a summary of licenses across all projects in the group.

The group's Dependency List, which shows all dependencies for all projects.

The group's Audit Events page, which logs all license policy changes.

The group's CI/CD Analytics page, which shows pipeline success rates.

A compliance officer wants to track the status of license approvals over time. They need to see when a license was added to the approved list and by whom. Where can they find this information?

The merge request that added the license to the approved list.

The License Compliance report in the latest pipeline.

The group's Audit Events page, which logs changes to license compliance policies.

The project's Settings > General > Compliance page.

What is the purpose of defining a license compliance policy in GitLab?

To generate a list of all licenses used in the project for documentation

To ensure the project's own license is compatible with all dependencies

To block the use of dependencies with licenses that are not approved

To automatically update dependency licenses to approved versions

A project manager wants to ensure that all dependencies in a project are covered by a license that is either approved or has a pending review. They want to see a list of licenses that are not yet approved. What should they use?

The group's Audit Events page, which logs policy changes.

The project's Settings > Repository > Protected Branches page.

The License Compliance report, which shows the status of each license (approved, denied, or pending).

The project's Dependency List, which shows all dependencies but not their license status.

A company has a strict policy that any new license must be approved by legal before it can be used. They want to automate the detection of new licenses, but they also want to allow developers to proceed with development without waiting for legal approval, as long as the merge is not completed. They are considering using a 'warn' policy. What is the trade-off they should consider?

A 'warn' policy requires legal approval before the pipeline can run, which slows down development.

A 'warn' policy is equivalent to a 'deny' policy but with a softer message.

A 'warn' policy will still block the merge if the license is not approved, but it will not fail the pipeline.

A 'warn' policy allows the merge to proceed even without legal approval, which may violate the strict policy.

GitLabCertified Security Associate

Domain 6Objective 1

Enforce License Compliance GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 2)

Part of the License Compliance domain, which makes up ~10% of our current practice bank.

14questions here

3free pages

4concepts

Questions 6–10

6application · medium
A security analyst needs to identify which projects in a group have dependencies with a license that is on the company's deny list. They want a quick overview without opening each project individually. What should they use?
Select an answer first
7application · medium
A compliance officer wants to track the status of license approvals over time. They need to see when a license was added to the approved list and by whom. Where can they find this information?
Select an answer first
8foundation · medium
What is the purpose of defining a license compliance policy in GitLab?
Select an answer first
9application · medium
A project manager wants to ensure that all dependencies in a project are covered by a license that is either approved or has a pending review. They want to see a list of licenses that are not yet approved. What should they use?
Select an answer first
10expert · hard
A company has a strict policy that any new license must be approved by legal before it can be used. They want to automate the detection of new licenses, but they also want to allow developers to proceed with development without waiting for legal approval, as long as the merge is not completed. They are considering using a 'warn' policy. What is the trade-off they should consider?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.