Implement Container Scanning GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A container scan reports a critical vulnerability in a base image. The team has already upgraded the base image in a merge request, but the vulnerability still appears in the scan report. What is the most likely reason?

   • AThe scan is running on an old image that was built before the upgrade.
   • BThe severity threshold is set too low.
   • CThe vulnerability is a false positive.
   • DThe vulnerability database is outdated and has not been updated.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In the GitLab security lifecycle, where does container scanning typically fit?

   • ADuring the monitoring phase, after the application is in production
   • BDuring the runtime phase, after the container is deployed
   • CDuring the planning phase, before any code is written
   • DDuring the build phase, before the image is pushed to a registry
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the default behavior of container scanning in a merge request pipeline?

   • AIt runs on every merge request pipeline
   • BIt runs only when the Dockerfile is changed
   • CIt runs only when the merge request is approved
   • DIt runs only when the merge request targets the default branch
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A container scan report lists a vulnerability with a CVSS score of 7.5 and a severity of 'High'. The vulnerability is in a package that is used only in a development tool that is not included in the production image. The team wants to reduce noise in the report. What is the best action?

   • ACreate an issue to track the vulnerability.
   • BDismiss the vulnerability with a comment explaining that the package is not in the production image.
   • CUpgrade the package to a patched version.
   • DChange the severity threshold to 'critical' so high-severity vulnerabilities are ignored.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A container scan report lists a vulnerability with a CVSS score of 9.8 and a severity of 'Critical'. The vulnerability is in a library that is not used at runtime. What is the best course of action?

   • ADismiss the vulnerability because the library is not used at runtime.
   • BCreate an issue to track the vulnerability and assign it to the security team.
   • CUpgrade the library to a patched version.
   • DIgnore the vulnerability because it is not exploitable.
   Reveal Solution Discussion Select an answer first