A team has a monorepo with multiple independent services. They want to run SAST on the entire repository, but they are concerned that a failure in one service's scan will block the pipeline for all services. They want to isolate failures so that a scan failure in one service does not prevent other services from being deployed. What is the best approach?

Run a single SAST job for the entire repository and set `allow_failure: true`.

Use a single SAST job and configure it to only scan the changed files.

Create separate SAST jobs for each service, each with its own `allow_failure` setting.

Run SAST only on the default branch to avoid blocking feature branch pipelines.

A security team wants to add a custom SAST analyzer that checks for a proprietary security pattern in their internal configuration files. They have written a script that outputs findings in the GitLab SAST report format. How should they integrate this script into the pipeline?

Add the script as a custom analyzer by defining a new job that runs the script and publishes a `sast` report artifact.

Use the `SAST_CUSTOM_ANALYZERS` variable to point to the script.

Modify the existing SAST template to include the script in the default analyzers.

Place the script in the `bin/` directory of the repository and GitLab will automatically run it as part of SAST.

How does GitLab display SAST findings in a merge request?

As a separate email notification

In the 'Security' tab of the merge request

As comments on the diff by a bot

GitLabCertified Security Associate

Domain 1Objective 1

Implement Static Application Security Testing (SAST) GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 5)

Part of the Static and Dynamic Application Security Testing domain, which makes up ~19% of our current practice bank.

24questions here

5free pages

7concepts

Questions 21–24

21foundation · easy
Which GitLab SAST variable is used to exclude specific paths from being scanned?
Select an answer first
22expert · medium
A team has a monorepo with multiple independent services. They want to run SAST on the entire repository, but they are concerned that a failure in one service's scan will block the pipeline for all services. They want to isolate failures so that a scan failure in one service does not prevent other services from being deployed. What is the best approach?
Select an answer first
23application · medium
A security team wants to add a custom SAST analyzer that checks for a proprietary security pattern in their internal configuration files. They have written a script that outputs findings in the GitLab SAST report format. How should they integrate this script into the pipeline?
Select an answer first
24foundation · easy
How does GitLab display SAST findings in a merge request?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.

Implement Static Application Security Testing (SAST) GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 5)

Questions 21–24

Which GitLab SAST variable is used to exclude specific paths from being scanned?

A security team wants to add a custom SAST analyzer that checks for a proprietary security pattern in their internal configuration files. They have written a script that outputs findings in the GitLab SAST report format. How should they integrate this script into the pipeline?

How does GitLab display SAST findings in a merge request?

Keep studying — Static and Dynamic Application Security Testing