A company uses an external security information and event management (SIEM) system to centralize security alerts. The security team wants GitLab security policy violations to be sent to the SIEM for correlation with other events. Which integration should be configured?

Service Desk integration with the SIEM

Compliance pipeline that calls the SIEM's API

What is the purpose of a compliance pipeline in GitLab?

To run required checks on projects to enforce compliance requirements

To automatically merge merge requests that pass all checks

To run security scans on the project's code

To generate compliance reports for external auditors

A company wants to enforce a compliance pipeline that runs a set of security scans on all projects in a group. The pipeline should be defined once and automatically applied to all projects. What is the best way to achieve this?

Add the pipeline definition to each project's .gitlab-ci.yml file.

Use a CI/CD template that is included in every project.

Create a compliance framework with a compliance pipeline and assign it to the group.

Create a group-level CI/CD variable that triggers the pipeline.

A security policy is configured to block merge requests if a high-severity vulnerability is detected. However, a developer has a merge request that includes a high-severity vulnerability that is a false positive. The developer wants to merge the request. What is the best way to handle this?

Create a policy exception for the specific merge request, allowing it to bypass the vulnerability check.

Ask a maintainer to merge the request directly to the main branch, bypassing the merge request pipeline.

Disable the security policy temporarily, merge the request, then re-enable it.

Add the vulnerability to the project's allowlist in the security scanner.

GitLabCertified Security Associate

Domain 4Objective 3

Enforce Policy Compliance GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 2)

Part of the Security Policies and Approvals domain, which makes up ~19% of our current practice bank.

25questions here

5free pages

6concepts

Questions 6–10

6foundation · easy
Which GitLab feature is commonly used to connect a compliance pipeline to an external compliance tool?
Select an answer first
7application · medium
A company uses an external security information and event management (SIEM) system to centralize security alerts. The security team wants GitLab security policy violations to be sent to the SIEM for correlation with other events. Which integration should be configured?
Select an answer first
8foundation · easy
What is the purpose of a compliance pipeline in GitLab?
Select an answer first
9application · medium
A company wants to enforce a compliance pipeline that runs a set of security scans on all projects in a group. The pipeline should be defined once and automatically applied to all projects. What is the best way to achieve this?
Select an answer first
10expert · hard
A security policy is configured to block merge requests if a high-severity vulnerability is detected. However, a developer has a merge request that includes a high-severity vulnerability that is a false positive. The developer wants to merge the request. What is the best way to handle this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.