Implement Container Scanning GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A team wants to enforce a security gate so that merge requests are blocked when container scanning finds a high-severity vulnerability. They have enabled container scanning and it runs on merge requests. What additional configuration is required?

   • ACreate a new pipeline that runs on merge requests and manually checks the scan report.
   • BConfigure the Security Configuration UI to set the severity threshold to 'high'.
   • CAdd a merge request approval rule that requires a security approval.
   • DSet the container scanning job's `allow_failure` to `false`.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A container scan report shows a vulnerability with a severity of 'Medium' in a package that is only used during the build stage, not in the final image. What is the best action?

   • AUpgrade the package to a patched version.
   • BCreate an issue to track the vulnerability.
   • CIgnore the vulnerability because it is only medium severity.
   • DDismiss the vulnerability because the package is not in the final image.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A team wants container scanning to run only on merge requests targeting the `main` branch, and they want to fail the merge request if any critical vulnerability is found. They have already enabled container scanning. What is the most efficient way to configure this?

   • ACreate a separate pipeline that runs only on `main` and have it scan the image after merge.
   • BUse the Security Configuration UI to set the scan frequency to 'on merge request' and the severity threshold to 'critical'.
   • CConfigure the merge request approval rules to require a security approval when a critical vulnerability is present.
   • DAdd a `rules:` section to the container scanning job so it runs only when the pipeline is for a merge request with `main` as the target branch, and set the job's `allow_failure` to `false`.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which action can a user take directly from a vulnerability finding in GitLab to track remediation work?

   • AAdd a comment to the Dockerfile
   • BMerge the current merge request
   • CSend an email to the project owner
   • DCreate a GitLab issue
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A team has container scanning enabled and it runs on merge requests. They want to block merge requests when a critical vulnerability is found, but they also want to allow the security team to override the block for a specific merge request. What is the best way to achieve this?

   • ASet the severity threshold to 'critical' and leave `allow_failure` as the default.
   • BSet `allow_failure: true` and rely on the vulnerability report to manually block merge requests.
   • CSet `allow_failure: false` on the container scanning job and configure merge request approval rules to allow a security team member to approve and merge.
   • DCreate a custom script that checks the scan report and fails the pipeline if a critical vulnerability is found.
   Reveal Solution Discussion Select an answer first