Enforce Policy Compliance GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How can GitLab integrate with an external compliance tool to extend enforcement capabilities?

   • ABy using the external tool's API within a compliance pipeline job
   • BBy using GitLab's built-in compliance features only
   • CBy manually copying compliance reports to the external tool
   • DBy using webhooks to send compliance data to the external tool
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company uses an external GRC (governance, risk, and compliance) tool to manage compliance evidence. The security team wants to automatically send compliance pipeline results to the GRC tool. The GRC tool only accepts data via a specific API. What is the best way to integrate GitLab with the GRC tool?

   • AManually export the compliance report and upload it to the GRC tool.
   • BUse a webhook to send pipeline events to the GRC tool's API.
   • CUse a compliance pipeline job that calls the GRC tool's API with the pipeline results.
   • DUse the audit event log to trigger a script that sends data to the GRC tool.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How do you apply a compliance pipeline to a project in GitLab?

   • ABy associating a compliance framework that includes a compliance pipeline with the project
   • BBy adding a .gitlab-ci.yml file to the project root
   • CBy enabling a compliance pipeline in the project's CI/CD settings
   • DBy creating a compliance pipeline in the project's pipeline editor
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A healthcare organization uses a compliance pipeline to run security scanning on all projects. The pipeline is defined in a separate repository and referenced by all projects. Recently, a developer accidentally modified the pipeline definition in a project's own .gitlab-ci.yml, bypassing the required scan. What is the most effective way to prevent this bypass?

   • AUse a pre-commit hook in each project to check for the security scan.
   • BAdd a CI job in each project that runs the security scan and fails if the scan is not present.
   • CCreate a compliance report and manually review each project's pipeline configuration.
   • DUse the compliance pipeline configuration to enforce the pipeline and prevent project-level overrides.
   Reveal Solution Discussion Select an answer first
6. 15application · easy

   A compliance officer needs to see a list of all policy violations that have occurred in the last 30 days across all projects. Which report or view should the officer use?

   • ASecurity dashboard
   • BPipeline reports
   • CAudit event log
   • DCompliance Center's policy violations report
   Reveal Solution Discussion Select an answer first