A dependency scan flags a moderate vulnerability in a library that is a transitive dependency of a core package. The direct package has not released an update that fixes it. What is the most appropriate remediation action?

Remove the direct package entirely

Ignore the finding because it is only transitive

Manually patch the library's source code in the project

Check for a newer version of the direct package or use an override to force a patched transitive version

When prioritizing secret detection findings, which factor is MOST important to consider?

The length of the secret string

The file name where the secret was found

The age of the commit that introduced the secret

The type of secret and whether it is still valid

How can merge requests be used to facilitate remediation of a security finding?

By adding a comment to the merge request that mentions the finding

By assigning the merge request to a security reviewer

By creating a merge request that contains the fix for the finding

By closing the merge request without merging

A developer marked a dependency finding as a false positive because the vulnerable function is never called. Later, a security review reveals the function is reachable through an indirect code path. What should be done?

Reopen the finding and remediate the vulnerability

Mark it as a false positive again with a new reason

Keep the finding dismissed because the initial analysis was done

Ignore the review because the developer is the owner

A secret detection scan finds a hardcoded API key in a configuration file. The key is for a third-party service and is currently active. What is the immediate remediation step?

Change the file permissions to read-only

Revoke the key in the third-party service and generate a new one

Remove the key from the file and commit the change

Add the key to the .gitignore file

GitLabCertified Security Associate

Domain 2Objective 3

Remediate Detected Findings GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 1)

Part of the Secret and Dependency Scanning domain, which makes up ~21% of our current practice bank.

27questions here

6free pages

7concepts

Questions 1–5

1application · medium
A dependency scan flags a moderate vulnerability in a library that is a transitive dependency of a core package. The direct package has not released an update that fixes it. What is the most appropriate remediation action?
Select an answer first
2foundation · easy
When prioritizing secret detection findings, which factor is MOST important to consider?
Select an answer first
3foundation · easy
How can merge requests be used to facilitate remediation of a security finding?
Select an answer first
4application · medium
A developer marked a dependency finding as a false positive because the vulnerable function is never called. Later, a security review reveals the function is reachable through an indirect code path. What should be done?
Select an answer first
5application · medium
A secret detection scan finds a hardcoded API key in a configuration file. The key is for a third-party service and is currently active. What is the immediate remediation step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.