A secret detection scan finds two issues: a valid production API key in a public repository, and a valid staging API key in a private repository. Both keys are active. Which should be prioritized for remediation?

Neither is a priority because they are just keys

The production key in the public repository

Both should be handled simultaneously with equal priority

The staging key in the private repository

A developer merged a merge request that upgrades a vulnerable JavaScript library. How can the team verify that the dependency finding is truly resolved?

Wait for the next scheduled security scan

Confirm the merge request was approved by two reviewers

Review the diff to see the version number changed

Check the latest pipeline on the default branch for a successful dependency scan with no critical findings

A security team has a list of findings from secret and dependency scans. Which finding should be prioritized for immediate remediation?

A low-severity dependency vulnerability in a development-only tool

A high-severity vulnerability in a library used in production code

A low-severity secret detection finding that is a test credential

A medium-severity vulnerability in a library used only in test code

After applying a fix for a secret detection finding, how can a developer verify the remediation was successful?

Check the commit history for the secret

Delete the branch and create a new one

Ask a teammate to review the code

Run a new pipeline and confirm the secret is no longer detected

What is the recommended way to handle a dependency scanning finding that is a false positive?

Add the dependency to a blocklist

Remove the dependency from the project

Dismiss the finding with a reason in GitLab

Upgrade the dependency to the latest version

GitLabCertified Security Associate

Domain 2Objective 3

Remediate Detected Findings GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 5)

Part of the Secret and Dependency Scanning domain, which makes up ~21% of our current practice bank.

27questions here

6free pages

7concepts

Questions 21–25

21expert · hard
A secret detection scan finds two issues: a valid production API key in a public repository, and a valid staging API key in a private repository. Both keys are active. Which should be prioritized for remediation?
Select an answer first
22application · medium
A developer merged a merge request that upgrades a vulnerable JavaScript library. How can the team verify that the dependency finding is truly resolved?
Select an answer first
23foundation · easy
A security team has a list of findings from secret and dependency scans. Which finding should be prioritized for immediate remediation?
Select an answer first
24foundation · easy
After applying a fix for a secret detection finding, how can a developer verify the remediation was successful?
Select an answer first
25foundation · easy
What is the recommended way to handle a dependency scanning finding that is a false positive?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.