A company uses an external compliance tool to track audit findings. The security team wants to automatically create a finding in the external tool whenever a GitLab security policy violation occurs. What is the best way to integrate GitLab with the external tool?

Manually export the compliance report and import it into the external tool.

Use a webhook to send policy violation events to the external tool's API.

Use the audit event log to trigger a script that creates findings in the external tool.

Use a compliance pipeline job that calls the external tool's API when a violation is detected.

A company wants to ensure that all projects in a specific group comply with a set of security policies. The security team wants to see a summary of which policies are being violated across the group. What is the best way to get this overview?

Create a compliance pipeline that fails if any policy is violated.

Use the audit event log to find policy violations.

Check each project's security dashboard individually.

Use the Compliance Center to view policy violations for the group.

Which GitLab feature can be used to alert on policy violations without blocking the merge request?

Compliance pipelines with non-blocking jobs

A company wants to enforce a compliance pipeline that runs a dependency scanning job on all projects in a group. The pipeline should be defined once and automatically applied to all projects. What is the best way to achieve this?

Add the pipeline definition to each project's .gitlab-ci.yml file.

Create a compliance framework with a compliance pipeline and assign it to the group.

Use a CI/CD template that is included in every project.

Create a group-level CI/CD variable that triggers the pipeline.

A project manager wants to ensure that all merge requests to the main branch are reviewed by at least two approved reviewers. The project already has a security policy that requires a specific number of approvals. What is the correct way to enforce this requirement?

Use a security policy that blocks merge requests without two approvals.

Create a compliance pipeline that checks the number of approvals and fails if less than two.

Configure a merge request approval rule that requires two approvals from eligible approvers.

Add a CI job that requires two approvals before the pipeline can run.

GitLabCertified Security Associate

Domain 4Objective 3

Enforce Policy Compliance GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 4)

Part of the Security Policies and Approvals domain, which makes up ~19% of our current practice bank.

25questions here

5free pages

6concepts

Questions 16–20

16application · medium
A company uses an external compliance tool to track audit findings. The security team wants to automatically create a finding in the external tool whenever a GitLab security policy violation occurs. What is the best way to integrate GitLab with the external tool?
Select an answer first
17application · easy
A company wants to ensure that all projects in a specific group comply with a set of security policies. The security team wants to see a summary of which policies are being violated across the group. What is the best way to get this overview?
Select an answer first
18foundation · easy
Which GitLab feature can be used to alert on policy violations without blocking the merge request?
Select an answer first
19application · medium
A company wants to enforce a compliance pipeline that runs a dependency scanning job on all projects in a group. The pipeline should be defined once and automatically applied to all projects. What is the best way to achieve this?
Select an answer first
20application · easy
A project manager wants to ensure that all merge requests to the main branch are reviewed by at least two approved reviewers. The project already has a security policy that requires a specific number of approvals. What is the correct way to enforce this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.