Which remediation is appropriate for a confirmed Cross-Site Scripting (XSS) vulnerability in a web application?

Add a firewall rule to block all POST requests

Implement output encoding and input validation

Change the application's session timeout

Upgrade the web server's TLS version

What information is typically found in the 'evidence' section of a DAST finding?

The source code snippet where the vulnerability exists

The name of the developer who wrote the vulnerable code

The actual HTTP request and response that triggered the vulnerability

The CVSS score of the vulnerability

A security team reviews a SAST report for a microservices architecture and finds two high-severity findings: (1) a SQL injection in the user service, which is publicly accessible, and (2) a command injection in the admin service, which is only accessible from the internal network. Both are confirmed true positives. The team has limited resources and must choose one to fix first. What should the team prioritize?

The command injection in the admin service, because it is high severity and could lead to full system compromise.

Both should be fixed simultaneously because both are high severity and cannot be delayed.

The SQL injection in the user service, because it is publicly accessible and has a higher likelihood of exploitation.

Neither should be fixed because high-severity findings are often false positives and need further validation.

What is the primary purpose of validating a scan finding?

To determine the cost of fixing the vulnerability

To assign a severity score to the vulnerability

To confirm whether the reported vulnerability is genuine or a false positive

To identify the developer responsible for the vulnerable code

In a SAST finding, what does the 'location' field typically provide?

The name of the database table affected by the vulnerability

The IP address of the server hosting the application

The file path and line number where the vulnerable code is found

The URL of the endpoint that triggers the vulnerability

GitLabCertified Security Associate

Domain 1Objective 3

Interpret Application Security Scan Results GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 3)

Part of the Static and Dynamic Application Security Testing domain, which makes up ~19% of our current practice bank.

17questions here

4free pages

5concepts

Questions 11–15

11foundation · easy
Which remediation is appropriate for a confirmed Cross-Site Scripting (XSS) vulnerability in a web application?
Select an answer first
12foundation · easy
What information is typically found in the 'evidence' section of a DAST finding?
Select an answer first
13expert · hard
A security team reviews a SAST report for a microservices architecture and finds two high-severity findings: (1) a SQL injection in the user service, which is publicly accessible, and (2) a command injection in the admin service, which is only accessible from the internal network. Both are confirmed true positives. The team has limited resources and must choose one to fix first. What should the team prioritize?
Select an answer first
14foundation · easy
What is the primary purpose of validating a scan finding?
Select an answer first
15foundation · easy
In a SAST finding, what does the 'location' field typically provide?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.