Interpret Application Security Scan Results GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When reviewing a SAST report, what does the 'confidence' field primarily indicate?

   • AThe severity of the vulnerability if it were exploited
   • BThe likelihood that the reported finding is a true positive rather than a false positive
   • CThe number of times the vulnerable code path is executed during testing
   • DThe difficulty an attacker would face in exploiting the vulnerability
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team reviews a SAST report for a large application and finds two critical-severity issues: (1) a SQL injection in an admin-only endpoint that is rarely used, and (2) a stored XSS in a public comment section that is heavily used. Both are confirmed true positives. The team has resources to fix only one issue this sprint. Which issue should be prioritized?

   • AThe SQL injection, because it is critical severity and could lead to full database compromise.
   • BBoth should be fixed simultaneously because both are critical severity and cannot be delayed.
   • CThe stored XSS, because it affects a public and heavily used feature, increasing the likelihood of exploitation and business impact.
   • DNeither should be fixed because critical findings are often false positives and need further validation.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which action is most appropriate when validating a SAST finding that flags a potential SQL injection?

   • AImmediately deploy a patch to the production server
   • BChange the severity of the finding to critical
   • CReview the surrounding code to see if user input is properly sanitized
   • DIgnore the finding because SAST tools are known to produce many false positives
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why is business impact an important factor when prioritizing vulnerabilities?

   • AIt helps determine which vulnerabilities could cause the most damage to the organization
   • BIt shows the exact location of the vulnerability in the code
   • CIt measures the number of users affected by the vulnerability
   • DIt indicates the technical difficulty of exploiting the vulnerability
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A DAST scan of a healthcare application reports a critical-severity finding for an unauthenticated API endpoint that returns patient data. The analyst reviews the request and response and confirms the data is exposed. However, the endpoint is rate-limited to 10 requests per minute per IP address. The analyst is deciding whether to escalate this finding. What should the analyst do?

   • ADeprioritize the finding because the rate limit makes it difficult to extract large amounts of data.
   • BMark the finding as a false positive because the rate limit is a security control that mitigates the vulnerability.
   • CEscalate the finding as critical because the data is sensitive and the rate limit does not prevent data exposure.
   • DIgnore the finding because DAST scans are not reliable for API endpoints, and the rate limit is sufficient.
   Reveal Solution Discussion Select an answer first