Implement Static Application Security Testing (SAST) GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A team uses GitLab SAST on a monorepo containing both a Ruby on Rails API and a React frontend. The SAST scan is producing many findings in the `vendor/` directory that are not relevant to the team. They want to exclude this directory from scanning while keeping all other analyzers active. What is the most efficient way to achieve this?

   • AAdd a `.gitignore` entry for `vendor/` so GitLab skips it during scanning.
   • BMove the `vendor/` directory to a separate repository and include it as a submodule.
   • CCreate a custom analyzer that skips the `vendor/` directory and replace the default analyzers.
   • DSet `SAST_EXCLUDED_PATHS: vendor/` in the SAST job's variables.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A team has SAST enabled in their pipeline. Recently, the SAST job started failing because one of the analyzers crashed due to a memory limit. The team wants the pipeline to continue even if the SAST job fails, but they still want the scan results to appear in merge requests. What should they configure?

   • ADisable the SAST job entirely and run it manually.
   • BSet `allow_failure: true` on the SAST job in the pipeline configuration.
   • CIncrease the pipeline timeout so the analyzer has more time to complete.
   • DSet `SAST_JOB_ALLOW_FAILURE: true` as a pipeline variable.
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   A large organization has multiple projects using GitLab SAST. They want to enforce a policy that blocks merge requests if any 'Critical' vulnerability is found, but they want to allow 'High' and lower severities to be merged without approval. They also want to exempt a specific project from this policy because it is a legacy application that is being decommissioned. How should they implement this?

   • ASet `SAST_FAIL_ON_SEVERITY: critical` in each project's pipeline configuration.
   • BCreate a custom script in each project that fails the pipeline if Critical findings exist.
   • CCreate a merge request approval policy that requires approval for Critical findings, and apply it to all projects except the legacy one.
   • DUse the GitLab API to check for Critical findings and block merges via a webhook.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In a GitLab CI/CD pipeline, how do you enable SAST for a project?

   • ABy setting the `SAST_ENABLED` variable to `true` in the project settings
   • BBy adding the `sast` job to the `.gitlab-ci.yml` file using the `include` directive
   • CBy installing a SAST plugin in the GitLab server
   • DBy running the `gitlab-sast` command in the repository root
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A development team wants to enforce a security gate so that merge requests cannot be merged if SAST finds any 'High' or 'Critical' severity vulnerabilities. They have already enabled SAST in the pipeline and the findings appear in merge requests. What additional configuration is required to enforce this gate?

   • ASet the `SAST_FAIL_ON_SEVERITY` variable to `high` in the SAST job.
   • BConfigure a merge request approval policy that requires approval when SAST finds High or Critical vulnerabilities.
   • CEnable the 'Block merge when pipeline fails' option in the project settings.
   • DAdd a `security_scans` job to the pipeline that fails if any High or Critical finding exists.
   Reveal Solution Discussion Select an answer first