A scan reports a high-severity vulnerability in a library used only in a legacy internal tool that is scheduled for decommissioning in two months. The library has no known exploit in the wild, and the tool is not internet-facing. What is the most appropriate action?

Upgrade the library immediately despite the decommissioning plan

Mark the finding as a false positive

Decommission the tool immediately

Document the risk, track the finding, and plan to fix it before decommissioning if time permits

What is the best way to confirm that a dependency vulnerability has been resolved after upgrading the package?

Wait for the next scheduled scan

Review the merge request comments

Check the dependency scanner report in the latest pipeline

Verify the package version in the lock file

A secret detection finding flags a string that looks like an API key but is actually a test fixture. What is the appropriate action?

Rotate the string as if it were a real secret

Remove the string from the code

Mark the finding as a false positive in GitLab

Ignore the finding without any action

A dependency scan flags a critical vulnerability in a Python package used by a microservice. The maintainer has released a patched version. What is the most efficient way to remediate this finding using GitLab's built-in features?

Create a merge request that updates the package version in the requirements file

Add the package to a vulnerability allowlist

Manually edit the file directly on the default branch

Delete the package from the project entirely

A security team wants to get a high-level view of all open vulnerabilities across multiple projects in a group to plan remediation sprints. Which GitLab feature is best suited for this?

The project's merge request approval rules

The individual project's pipeline editor

The Security Dashboard at the group level

GitLabCertified Security Associate

Domain 2Objective 3

Remediate Detected Findings GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 3)

Part of the Secret and Dependency Scanning domain, which makes up ~21% of our current practice bank.

27questions here

6free pages

7concepts

Questions 11–15

11expert · hard
A scan reports a high-severity vulnerability in a library used only in a legacy internal tool that is scheduled for decommissioning in two months. The library has no known exploit in the wild, and the tool is not internet-facing. What is the most appropriate action?
Select an answer first
12foundation · easy
What is the best way to confirm that a dependency vulnerability has been resolved after upgrading the package?
Select an answer first
13foundation · easy
A secret detection finding flags a string that looks like an API key but is actually a test fixture. What is the appropriate action?
Select an answer first
14application · medium
A dependency scan flags a critical vulnerability in a Python package used by a microservice. The maintainer has released a patched version. What is the most efficient way to remediate this finding using GitLab's built-in features?
Select an answer first
15application · medium
A security team wants to get a high-level view of all open vulnerabilities across multiple projects in a group to plan remediation sprints. Which GitLab feature is best suited for this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.