Which remediation strategy is most appropriate when a security patch for a vulnerability is not yet available?

Implement a compensating control to reduce the risk until a patch is released.

Increase the CVSS score to escalate the issue.

Uninstall the affected software permanently.

Ignore the vulnerability until a patch is released.

A DevOps team uses GitLab to manage a public-facing web application. A vulnerability scan identifies a critical-severity flaw in a third-party JavaScript library used by the frontend. The library is loaded directly from the application's server, and the flaw allows reflected cross-site scripting (XSS). The team cannot update the library for two weeks due to a contractual freeze on dependency changes. Which remediation strategy should the team apply in the interim?

Disable JavaScript in the browser for all users of the application.

Accept the risk and take no action until the dependency freeze ends.

Remove the library from the application and rewrite the affected functionality using native JavaScript.

Implement a Web Application Firewall (WAF) rule to filter malicious XSS payloads in HTTP requests.

A system administrator applied a security patch to a Linux server to remediate a privilege escalation vulnerability. After the patch, the administrator wants to verify that the remediation was effective without introducing regressions. Which verification step should the administrator perform?

Re-run the vulnerability scanner and confirm the finding is no longer present, then run the application's test suite.

Review the vulnerability report and mark the finding as resolved without further testing.

Check the patch installation log and assume the vulnerability is resolved because the patch applied successfully.

Reboot the server and verify that all services start successfully.

During vulnerability triage, which sequence of steps is most appropriate for prioritizing reported vulnerabilities?

Wait for the vendor to provide a patch before assessing any vulnerability.

Immediately patch all vulnerabilities in the order they were reported, regardless of severity.

Assign a severity score, then assess exploitability and impact, then prioritize based on the combination.

Prioritize based solely on the number of affected systems, without considering severity or exploitability.

A security analyst triaged a vulnerability in a production application and decided to accept the risk because the application is scheduled for decommissioning in 30 days. The analyst documented the decision in the vulnerability management tool. A compliance auditor later questions why the vulnerability was not remediated. What should the analyst provide to justify the decision?

A new vulnerability scan showing the finding is still present.

A verbal explanation that the application is being decommissioned.

The original vulnerability scan report showing the finding.

The documented risk acceptance, including the CVSS score, the decommissioning date, and the business owner's approval.

GitLabCertified Security Associate

Domain 5Objective 2

Triage and Remediate Vulnerabilities GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 3)

Part of the Vulnerability Management domain, which makes up ~16% of our current practice bank.

27questions here

6free pages

5concepts

Questions 11–15

11foundation · easy
Which remediation strategy is most appropriate when a security patch for a vulnerability is not yet available?
Select an answer first
12application · medium
A DevOps team uses GitLab to manage a public-facing web application. A vulnerability scan identifies a critical-severity flaw in a third-party JavaScript library used by the frontend. The library is loaded directly from the application's server, and the flaw allows reflected cross-site scripting (XSS). The team cannot update the library for two weeks due to a contractual freeze on dependency changes. Which remediation strategy should the team apply in the interim?
Select an answer first
13application · medium
A system administrator applied a security patch to a Linux server to remediate a privilege escalation vulnerability. After the patch, the administrator wants to verify that the remediation was effective without introducing regressions. Which verification step should the administrator perform?
Select an answer first
14foundation · easy
During vulnerability triage, which sequence of steps is most appropriate for prioritizing reported vulnerabilities?
Select an answer first
15expert · hard
A security analyst triaged a vulnerability in a production application and decided to accept the risk because the application is scheduled for decommissioning in 30 days. The analyst documented the decision in the vulnerability management tool. A compliance auditor later questions why the vulnerability was not remediated. What should the analyst provide to justify the decision?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.

Triage and Remediate Vulnerabilities GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 3)

Questions 11–15

Which remediation strategy is most appropriate when a security patch for a vulnerability is not yet available?

A system administrator applied a security patch to a Linux server to remediate a privilege escalation vulnerability. After the patch, the administrator wants to verify that the remediation was effective without introducing regressions. Which verification step should the administrator perform?

During vulnerability triage, which sequence of steps is most appropriate for prioritizing reported vulnerabilities?

Keep studying — Vulnerability Management