Manage Vulnerabilities Across the DevSecOps Lifecycle GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security manager needs to communicate the current vulnerability posture to the executive team. The manager wants to show trends over time and highlight areas that need attention. Which GitLab feature is most appropriate for this?

   • AThe Vulnerability Report, filtered by severity and status.
   • BThe Merge Request approval settings, which enforce security checks.
   • CThe CI/CD pipeline logs, which show the results of security scans.
   • DThe Security Dashboard, which aggregates vulnerabilities across projects and shows historical trends.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In GitLab, which feature is used to assign a vulnerability to a specific team member for remediation and to track its status?

   • AMilestone
   • BIssue
   • CEpic
   • DMerge Request
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security analyst is triaging a vulnerability that has a CVSS score of 7.5 and is present in a library used in a public-facing API. The library is not directly exposed, but the API processes user input that could reach the vulnerable code. There is no known exploit. What should the analyst do?

   • AIgnore it because the library is not directly exposed.
   • BMark it as high priority because the API is public-facing.
   • CImmediately patch the library without further analysis.
   • DMark it as low priority because there is no known exploit.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   During triage, a vulnerability is found in a library that is only used in a non-critical internal tool. The vulnerability has a high CVSS score but is not directly accessible to external users. What should be the primary consideration when prioritizing this vulnerability?

   • AThe age of the library
   • BBusiness impact and exploitability in the specific context
   • CThe CVSS score alone
   • DThe number of dependencies that use the library
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A company wants to enforce a security gate that blocks the deployment of a container image if it contains a critical vulnerability. They use GitLab CI/CD with container scanning. What is the most effective way to implement this?

   • AAdd a manual approval step in the pipeline that requires a security analyst to review the container scan report.
   • BConfigure the container scanning job to fail the pipeline if a critical vulnerability is found.
   • CUse the Vulnerability Report to check for critical vulnerabilities before deployment.
   • DSet up a webhook to notify the security team when a critical vulnerability is found.
   Reveal Solution Discussion Select an answer first