A security team is using GitLab SAST and has configured a custom rule to detect a specific vulnerability pattern. The rule is producing many false positives because it matches a common code pattern that is not always vulnerable. The team wants to reduce false positives without excluding entire files or disabling the rule. What is the best approach?

Dismiss each false positive manually in the merge request.

Disable the custom rule and rely on the default analyzers.

Refine the custom rule to include additional context checks, such as checking if the variable is user-controlled.

Exclude the files where the false positives occur using `SAST_EXCLUDED_PATHS`.

What is the primary purpose of Static Application Security Testing (SAST) in the software development lifecycle?

To analyze running applications for runtime vulnerabilities

To encrypt all sensitive data stored in the application's database

To scan source code for security vulnerabilities without executing the application

To monitor production traffic for malicious activity

What is a 'false positive' in the context of SAST results?

A reported vulnerability that does not actually exist in the code

A vulnerability that is actually present but not detected by the scanner

A vulnerability that is only present in test code

A vulnerability that is fixed automatically by the scanner

GitLabCertified Security Associate

Domain 1Objective 1

Implement Static Application Security Testing (SAST) GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 3)

Part of the Static and Dynamic Application Security Testing domain, which makes up ~19% of our current practice bank.

24questions here

5free pages

7concepts

Questions 11–15

11expert · medium
A security team is using GitLab SAST and has configured a custom rule to detect a specific vulnerability pattern. The rule is producing many false positives because it matches a common code pattern that is not always vulnerable. The team wants to reduce false positives without excluding entire files or disabling the rule. What is the best approach?
Select an answer first
12foundation · easy
Which GitLab SAST analyzer is designed for scanning Python code?
Select an answer first
13foundation · easy
Which artifact file does the GitLab SAST job produce by default?
Select an answer first
14foundation · easy
What is the primary purpose of Static Application Security Testing (SAST) in the software development lifecycle?
Select an answer first
15foundation · easy
What is a 'false positive' in the context of SAST results?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.

Implement Static Application Security Testing (SAST) GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 3)

Questions 11–15

Which GitLab SAST analyzer is designed for scanning Python code?

Which artifact file does the GitLab SAST job produce by default?

What is the primary purpose of Static Application Security Testing (SAST) in the software development lifecycle?

What is a 'false positive' in the context of SAST results?

Keep studying — Static and Dynamic Application Security Testing