Implement Static Application Security Testing (SAST) GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which benefit does SAST provide when integrated early in the software development lifecycle?

   • AIt allows developers to identify and fix vulnerabilities before code is deployed
   • BIt automatically patches vulnerabilities in the source code
   • CIt guarantees that the application is free from all security vulnerabilities
   • DIt eliminates the need for any manual code review
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of a security approval policy in GitLab?

   • ATo require approval before merging code that introduces security vulnerabilities
   • BTo notify the security team via email
   • CTo automatically fix vulnerabilities found by SAST
   • DTo encrypt the merge request data
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A security team is evaluating whether to adopt GitLab SAST for a new project. They have a mix of developers who are new to security scanning and are concerned about the learning curve. They also want to ensure that security findings are visible to developers early in the development process. What is the best way to introduce SAST to this team?

   • AEnable SAST with the default template and set `allow_failure: true` so developers can see findings without blocking their work.
   • BRun SAST only on the default branch and share the results via email.
   • CDisable SAST until the team has completed security training.
   • DEnable SAST and configure a strict merge request approval policy that blocks all findings.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is starting a new project written in Go. The security team wants to add SAST scanning to the CI/CD pipeline. They are using the GitLab-managed SAST template. What should they do to ensure the Go analyzer runs?

   • ASet `SAST_ANALYZER_IMAGE: registry.gitlab.com/security-products/gosec` in the pipeline.
   • BInstall the gosec analyzer as a custom analyzer in the project settings.
   • CManually add a job that runs `gosec` and publishes the results as a SAST report artifact.
   • DEnable the SAST.gitlab-ci.yml template; the Go analyzer (gosec) will run automatically because the project contains Go files.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A startup is adopting GitLab and wants to introduce security scanning early in the development process. They plan to run SAST on every commit to catch vulnerabilities before they reach production. The team is concerned about pipeline speed and wants to minimize the impact of SAST on developer productivity. What is the best approach?

   • ARun SAST only on the default branch to reduce pipeline time.
   • BRun SAST on every merge request and on the default branch, using the default template for efficiency.
   • CRun SAST only when a developer manually triggers it.
   • DRun SAST only on a nightly schedule to avoid impacting developer pipelines.
   Reveal Solution Discussion Select an answer first