Manage Vulnerabilities Across the DevSecOps Lifecycle GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   A vulnerability has been remediated and verified. The security team wants to ensure that the vulnerability does not reappear in future scans. What should they do?

   • ADo nothing because the vulnerability is fixed.
   • BClose the vulnerability and rely on future scans to catch it if it reappears.
   • CAdd the vulnerability to a whitelist to prevent it from being reported again.
   • DCreate a custom rule to automatically close any future occurrences.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security manager wants to present a vulnerability report to the board of directors. The report should show the overall risk posture and highlight improvements over the last quarter. Which data presentation would be most effective?

   • AA trend chart showing the number of open critical and high vulnerabilities over time.
   • BA table of vulnerabilities by project with the number of days open.
   • CA list of all open vulnerabilities sorted by severity.
   • DA summary of the number of vulnerabilities fixed in the last quarter.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   After a developer applies a fix for a vulnerability, what is the best practice to verify that the fix is effective?

   • ARe-run the security scan that originally detected the vulnerability
   • BAssign the vulnerability to another developer
   • CIgnore the vulnerability and move on
   • DClose the vulnerability immediately without further checks
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company wants to enforce a security gate in their CI/CD pipeline so that a merge request cannot be merged if it introduces a new critical vulnerability. They use GitLab Ultimate. What is the most effective way to achieve this?

   • AConfigure the pipeline to fail if the security scanning jobs report a critical vulnerability.
   • BSet up a webhook to notify the security team when a critical vulnerability is found.
   • CAdd a manual job to the pipeline that requires a security analyst to approve the merge request.
   • DUse the Vulnerability Report to manually check for critical vulnerabilities before merging.
   Reveal Solution Discussion Select an answer first