In GitLab, which of the following best describes the typical remediation workflow for a dependency scanning finding?

Create a merge request to update the dependency, then verify the pipeline passes and the vulnerability is resolved

Ignore the finding because dependency vulnerabilities are low risk

Delete the lock file and regenerate it from scratch

Automatically upgrade the dependency in the default branch without human review

A developer wants to see the status of all vulnerabilities in a single project, including which are resolved and which are still open. Where should they look?

The project's repository file tree

The project's CI/CD pipeline logs

The project's merge request list

The project's Security tab in the Vulnerability Report

A secret detection scan finds a valid Slack API token in a commit from three weeks ago. The token has been rotated since then, and the file has been removed from the current branch. What is the most appropriate remediation action?

Purge the token from the entire git history

Mark the finding as resolved because the token is already rotated and removed

Leave the finding open indefinitely for auditing

Rotate the token again to be safe

A developer discovers a valid AWS access key committed to a public repository. What is the FIRST remediation action they should take?

Add a .gitignore entry for the file

Change the file permissions to private

Delete the repository to remove the secret

Rotate the AWS access key to invalidate the exposed credential

When a vulnerable dependency has no patched version available, what is an appropriate remediation action?

Delete the lock file to force a fresh install

Apply a workaround or mitigation as recommended by the security advisory

Disable the dependency scanner for the project

Accept the risk without any action

GitLabCertified Security Associate

Domain 2Objective 3

Remediate Detected Findings GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 4)

Part of the Secret and Dependency Scanning domain, which makes up ~21% of our current practice bank.

27questions here

6free pages

7concepts

Questions 16–20

16foundation · easy
In GitLab, which of the following best describes the typical remediation workflow for a dependency scanning finding?
Select an answer first
17application · medium
A developer wants to see the status of all vulnerabilities in a single project, including which are resolved and which are still open. Where should they look?
Select an answer first
18expert · hard
A secret detection scan finds a valid Slack API token in a commit from three weeks ago. The token has been rotated since then, and the file has been removed from the current branch. What is the most appropriate remediation action?
Select an answer first
19foundation · easy
A developer discovers a valid AWS access key committed to a public repository. What is the FIRST remediation action they should take?
Select an answer first
20foundation · easy
When a vulnerable dependency has no patched version available, what is an appropriate remediation action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.