A vulnerability has been assigned to a developer for remediation. The developer has updated the library to a patched version. What is the next step in the remediation workflow?

Assign the vulnerability to another developer for a second opinion.

Update the vulnerability's status to 'needs triage'.

Close the vulnerability immediately.

Run the security scans again to verify that the vulnerability is no longer detected.

A critical vulnerability is found in a production application. The fix requires a library upgrade that may cause a breaking change. The security team wants to remediate quickly, but the development team is concerned about stability. What is the best approach?

Assess the risk of the vulnerability and the impact of the upgrade, then decide whether to apply the upgrade or implement a compensating control.

Delay the upgrade until the next scheduled maintenance window.

Apply the upgrade immediately to the production environment.

Ask the security team to manually verify the fix without testing.

A security analyst is triaging a list of vulnerabilities. Which factor is most directly used to prioritize a vulnerability based on the potential damage if it were exploited?

The number of lines of code in the affected file

The developer who committed the code

The date the vulnerability was first reported

GitLabCertified Security Associate

Domain 5Objective 1

Manage Vulnerabilities Across the DevSecOps Lifecycle GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 1)

Part of the Vulnerability Management domain, which makes up ~16% of our current practice bank.

24questions here

5free pages

6concepts

Questions 1–5

1foundation · easy
A GitLab project includes a Dockerfile that builds a container image. Which GitLab security scanning tool is specifically designed to identify vulnerabilities in the container image's base operating system and installed packages?
Select an answer first
2application · easy
A vulnerability has been assigned to a developer for remediation. The developer has updated the library to a patched version. What is the next step in the remediation workflow?
Select an answer first
3foundation · easy
Which GitLab feature provides a visual summary of vulnerabilities across a project, including counts by severity, and is useful for communicating risk to stakeholders?
Select an answer first
4expert · hard
A critical vulnerability is found in a production application. The fix requires a library upgrade that may cause a breaking change. The security team wants to remediate quickly, but the development team is concerned about stability. What is the best approach?
Select an answer first
5foundation · easy
A security analyst is triaging a list of vulnerabilities. Which factor is most directly used to prioritize a vulnerability based on the potential damage if it were exploited?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.

Manage Vulnerabilities Across the DevSecOps Lifecycle GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 1)

Questions 1–5

A GitLab project includes a Dockerfile that builds a container image. Which GitLab security scanning tool is specifically designed to identify vulnerabilities in the container image's base operating system and installed packages?

A vulnerability has been assigned to a developer for remediation. The developer has updated the library to a patched version. What is the next step in the remediation workflow?

Which GitLab feature provides a visual summary of vulnerabilities across a project, including counts by severity, and is useful for communicating risk to stakeholders?

A critical vulnerability is found in a production application. The fix requires a library upgrade that may cause a breaking change. The security team wants to remediate quickly, but the development team is concerned about stability. What is the best approach?

A security analyst is triaging a list of vulnerabilities. Which factor is most directly used to prioritize a vulnerability based on the potential damage if it were exploited?

Keep studying — Vulnerability Management