GitLab Security Specialist

The exam is delivered in English and organized into five equally weighted domains, each worth 20% of the score. The published source does not state the number of questions, the time limit, or the passing score, so confirm those details with the exam provider before scheduling. Expect scenario-based questions that test applied judgment rather than recall of marketing claims.

Difficulty is moderate to high for candidates without hands-on GitLab security experience. Because every domain carries equal weight, a strong background in one area cannot compensate for a weak one. The questions reward practical understanding of how scanning, policies, and audit evidence work inside the pipeline, so lab experience matters more than memorizing feature names.

The source material does not describe a retake policy, including waiting periods or fees. Check the exam provider's candidate handbook or contact support for the current rules. In the meantime, treat any retake as a chance to focus on your lowest-scoring domain, since each domain contributes exactly 20% of the total score.

The source does not state the exam duration or a recommended preparation time. As a practical guide, budget several weeks of part-time study, weighted evenly across the five domains. Spend extra time on the domain where your hands-on experience is thinnest, and build at least one working pipeline that applies policies and scanning to both human and agent changes.

Start with Application Security Testing because it introduces scanning and findings in merge requests. Then study Governance & Compliance to see how policies and approvals gate changes. Move to Secrets Management and Supply Chain Security, which build on pipeline controls. Finish with Visibility & Measurement, since audit trails and reporting depend on concepts from all four earlier domains.

Candidates often treat security as a separate stage rather than something that runs inside the pipeline. Others assume agent changes bypass gates, when the same policies and approvals apply to human and agent changes alike. A third common mistake is ignoring audit evidence, such as being unable to explain what changed or who approved it.

No. This is an independent exam-content page and is not affiliated with, endorsed by, or sponsored by GitLab. GitLab is a trademark of Software Freedom Conservancy, and its use here is descriptive only. For official training and certification offerings, consult GitLab's own website and University resources directly.

Use GitLab's public documentation, University courses, and demo series, which the source names as resources. Pair reading with hands-on work: create a project, enable scanning, add approval policies, and review the resulting audit trail. The source also highlights the GitLab Security Standard as guidance for hardening a software factory, which is useful background even though this exam is independent.

The five domains are equally weighted at 20% each, so the score reflects balanced performance across all areas. The source does not publish a passing score. Ask the exam provider for the current threshold before you sit the exam, and do not rely on figures from older preparation materials, which may be out of date.