Interpret Application Security Scan Results GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SAST scan of a Java application reports a high-severity finding for an insecure deserialization vulnerability. The finding is in a library that is used by a legacy module that is scheduled for decommissioning in six months. The team is considering whether to fix the issue or accept the risk. What should the team do?

   • AIgnore the finding because the module is legacy and not actively used, so the vulnerability is not exploitable.
   • BAccept the risk because the module will be decommissioned soon, and document the decision with a risk acceptance.
   • CFix the issue immediately because insecure deserialization is a critical vulnerability that can lead to remote code execution.
   • DDecommission the module immediately to eliminate the vulnerability, even if it disrupts business operations.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team reviews a SAST report for a web application and identifies three findings: (1) a SQL injection in a login endpoint that is publicly accessible, (2) a hardcoded API key in a test file that is not deployed, and (3) a minor information disclosure in an error message that is only visible to authenticated admins. The team has limited development capacity this sprint. Which finding should be addressed first?

   • AThe information disclosure, because it is the easiest to fix and requires only a configuration change.
   • BThe SQL injection, because it is in a public-facing endpoint and has high business impact if exploited.
   • CThe hardcoded API key, because it is in a test file and can be fixed quickly with minimal effort.
   • DAll three should be fixed simultaneously because every vulnerability must be addressed regardless of risk.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which factor should be considered FIRST when prioritizing vulnerabilities for remediation?

   • AThe age of the vulnerability report
   • BThe severity of the vulnerability
   • CThe ease of fixing the vulnerability
   • DThe number of vulnerabilities found
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SAST report identifies a hardcoded password in a configuration file. The password is used to connect to a database. The team confirms the finding is a true positive. What is the most appropriate remediation step?

   • AMove the password to an environment variable or a secrets manager and update the application to read from there.
   • BChange the password to a stronger one and keep it in the configuration file for simplicity.
   • CEncrypt the configuration file so the password is not readable in plain text.
   • DRemove the password from the configuration file and require manual entry each time the application starts.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the most appropriate remediation for a confirmed SQL injection vulnerability in a web application?

   • ADisable the application's error messages
   • BIncrease the web server's memory allocation
   • CUse parameterized queries or prepared statements
   • DAdd a CAPTCHA to the login form
   Reveal Solution Discussion Select an answer first