Manage Vulnerabilities Across the DevSecOps Lifecycle GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which stage of the vulnerability lifecycle involves confirming that a remediation actually resolves the vulnerability?

   • AIdentification
   • BRemediation
   • CTriage
   • DVerification
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How can GitLab automatically respond to a vulnerability found during a CI/CD pipeline?

   • ABy failing the pipeline job and creating a vulnerability record
   • BBy sending an email to all developers
   • CBy deleting the vulnerable code
   • DBy automatically deploying the code to production
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team wants to track the mean time to remediate (MTTR) vulnerabilities across all projects. Which GitLab feature provides this metric?

   • AThe Vulnerability Report
   • BThe Security Dashboard
   • CThe Merge Request analytics
   • DThe CI/CD pipeline logs
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   A vulnerability is discovered in a project's dependency. The security team wants to ensure the vulnerability is tracked from discovery to remediation. Which sequence of actions best represents the vulnerability lifecycle?

   • ATriage, identify, remediate, close, and verify.
   • BIdentify, remediate, triage, close, and verify.
   • CRemediate, identify, triage, verify, and close.
   • DIdentify, triage, remediate, verify, and close.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is reviewing a vulnerability report and sees a vulnerability with a CVSS score of 9.8 in a library that is only used in a development tool, not in production. The vulnerability is not known to be exploited. How should the analyst prioritize this vulnerability?

   • ATreat it as medium priority because it is not in production and not actively exploited.
   • BIgnore it because it is not in production.
   • CTreat it as critical because the CVSS score is high.
   • DImmediately patch the library in all environments.
   Reveal Solution Discussion Select an answer first