GitLab Security Specialist exam-day guide
GitLab Security Specialist · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring the original, unexpired ID (passport or driver's license) with a name matching your registration exactly. Confirm with the provider which forms of ID are accepted and whether a secondary ID is required.
Exam appointment confirmation
Have your registration confirmation, order number, and any scheduling emails accessible. Know your exam session start time in your local time zone and the provider's check-in window.
Test your computer and network
If the exam is remote-proctored, run the provider's system check on the same machine and network you will use. Confirm browser version, webcam, microphone, and stable internet. For a test center, confirm the address and arrival instructions.
Quiet, private room (remote exams)
Clear the desk of notes, phones, and second screens. Confirm with the provider whether a whiteboard or scratch paper is allowed and how it must be shown or erased.
Know the allowed-resources policy
This is a specialist exam, so confirm with the provider whether documentation, a second monitor, or terminal access is permitted. Do not assume open-book rules; verify before exam day.
Review the official exam guide and domains
Re-read the provider's exam scope and weighting. Map each domain to your weak areas and spend the final days on gaps, not on material you already know.
Practice the GitLab security workflows hands-on
Be comfortable navigating vulnerability management, security scanning results, merge request approval policies, protected branches, and CI/CD variable controls in a GitLab instance. Hands-on familiarity matters more than memorizing UI labels.
Prepare for scenario-based questions
Expect questions that describe a security problem and ask for the best configuration or remediation. Practice explaining why one control is better than another, not just naming it.
Rest and logistics plan
Plan sleep, meals, and travel or login time so you arrive or connect early. Know the provider's late-arrival and rescheduling policy in advance.
Confirm scoring and result delivery
Check with the provider how the exam is scored (scaled score vs. percentage), whether partial credit exists, and when and how results are delivered.
Plan the day
Do a final gap review against the official domain list. Re-read your notes on the weakest two or three areas, especially access control, vulnerability management, and CI/CD security. Run one timed practice set to check pacing, then stop adding new material.
Verify all logistics: ID, appointment time, test center directions or remote-proctoring system check, and allowed resources. Resolve any technical issues now rather than on exam day.
Light review only: skim summaries, key terminology, and common misconfigurations. Prepare your workspace or bag, charge devices, and confirm the check-in process. Aim for a full night's sleep; avoid cramming new topics.
Eat and hydrate normally. Log in or arrive early per the provider's instructions. Close unrelated applications and notifications. Do a short warm-up by recalling the exam domains and your strategy for scenario questions.
Read each question fully and identify what is being asked (best control, first step, root cause). Answer confident questions first and flag uncertain ones for review. For scenario items, eliminate options that are technically wrong or out of scope before choosing. Watch the clock and reserve time to revisit flagged questions.
Note which domains felt difficult while memory is fresh, and confirm with the provider when and how your score will be delivered.
Rules to check
Follow the provider's identification policy exactly; present the original ID requested and confirm in advance what is accepted.
Do not bring or use unauthorized materials, devices, or people. Confirm with the provider what is allowed before the exam, and ask the proctor if unsure.
Stay within the provider's break rules. If breaks are permitted, confirm whether the timer continues and whether you may leave the camera view; do not assume.
Do not communicate with anyone other than the proctor during the exam, and do not screenshot, record, or share exam content.
Understand the scoring model before you start: confirm with the provider whether the passing score is scaled, whether questions are weighted, and whether unanswered questions count against you.
If a technical failure occurs, stop and contact the proctor or provider support immediately; do not attempt to fix it in a way that violates exam rules.
Arrive or connect on time per the provider's check-in window; late arrival and rescheduling terms vary, so confirm them beforehand.
Keep your workspace clear and your environment compliant with the provider's remote-proctoring rules; ask the proctor before adjusting anything during the session.