I85PREP
⌘ K
GitLab Security Specialist study materials
GitLab Security Specialist study resources

GitLab Security Specialist practice questions

One question at a time. Build your GitLab Security Specialist understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Application Security Testing

In a GitLab CI pipeline, which keyword enables SAST scanning by including the vendor-provided template?

  1. include Correct answer.
  2. trigger
  3. extends
  4. cache

Explanation

GitLab's built-in security analyzers are activated by using the include keyword to pull in a template such as Jobs/SAST.gitlab-ci.yml from the vendor templates repository. That inclusion injects the analyzer jobs into the pipeline so they run against the merged code.

Question 2Application Security Testing

Which report artifact type does a GitLab SAST job produce so results appear in the merge request security widget?

  1. sast Correct answer.
  2. junit
  3. dotenv
  4. coverage

Explanation

SAST analyzers emit a JSON report declared under artifacts:reports:sast, which GitLab parses to populate the security widget and vulnerability records. The report must follow the vendor's SAST report schema for ingestion to succeed.

Question 3Application Security Testing

Which type of scanning does GitLab Secret Detection perform?

  1. It inspects compiled binaries for embedded credentials.
  2. It scans the repository contents and history for committed secrets such as tokens and keys. Correct answer.
  3. It enforces password complexity on user accounts.
  4. It monitors runtime network traffic for leaked credentials.

Explanation

Secret Detection examines committed files and, when configured, the git history for patterns matching credentials like API keys and tokens. Findings flag secrets that were checked into the repository so they can be revoked and removed.

Question 4Application Security Testing

Which GitLab feature detects vulnerable dependencies by analyzing the project's lock files and dependency graph?

  1. License Compliance
  2. Container Scanning
  3. DAST
  4. Dependency Scanning Correct answer.

Explanation

Dependency Scanning reads manifest and lock files to build a dependency graph and compares components against known vulnerability advisories. It targets third-party libraries rather than the project's own source code.

Question 5Application Security Testing

What does GitLab DAST require to perform an active scan of a web application?

  1. A completed SAST report
  2. A reachable target URL for the running application Correct answer.
  3. Read access to the source repository
  4. A signed container image

Explanation

DAST is a black-box scanner that needs a deployed, reachable URL (often set via DAST_WEBSITE) to crawl and attack the running application. It does not depend on source code access, which distinguishes it from static analysis.

Question 6Application Security Testing

In the GitLab vulnerability lifecycle, what does it mean to change a vulnerability's status to 'Dismissed'?

  1. The finding is deleted from the database permanently.
  2. The finding is automatically fixed by an auto-remediation merge request.
  3. The finding is marked as accepted risk or false positive and removed from the active count. Correct answer.
  4. The finding is escalated to a confirmed critical incident.

Explanation

Dismissing a vulnerability records a decision that the finding is a false positive or an accepted risk, which removes it from the default open findings view. The record is retained with a dismissal reason so the decision is auditable.

Question 7Application Security Testing

Which GitLab file is used to define which dependency vulnerabilities should be ignored during Dependency Scanning?

  1. vulnerability-allowlist.yml Correct answer.
  2. dependency-scanning-ignore.json
  3. gitlab-ci-overrides.yaml
  4. sast-allowlist.txt

Explanation

The vulnerability-allowlist.yml file lets teams suppress specific dependency findings by advisory or package so accepted risks do not clutter results. It is referenced by the dependency scanning configuration rather than being an arbitrary ignore list.

Question 8Application Security Testing

Which GitLab feature analyzes a built container image for known OS package vulnerabilities?

  1. Secret Detection
  2. Container Scanning Correct answer.
  3. API Fuzzing
  4. Coverage-guided fuzzing

Explanation

Container Scanning inspects the packages inside a container image and matches them against vulnerability advisories. It complements Dependency Scanning, which covers application-level libraries rather than the image's OS layer.

Question 9Application Security Testing

A team wants SAST to run only on merge request pipelines and not on every branch push. Which approach best achieves this in GitLab CI?

  1. Disable the SAST template and rely on manual code review.
  2. Move the SAST job to a scheduled pipeline only.
  3. Set the SAST job's stage to .post.
  4. Set the SAST job's rules to run only for merge_request_event pipelines. Correct answer.

Explanation

Overriding the analyzer job's rules so it matches only merge_request_event pipelines restricts scanning to merge request contexts. This reduces pipeline load while still gating changes before merge.

Question 10Application Security Testing

A SAST job completes but no vulnerabilities appear in the merge request widget. Which cause is most likely?

  1. The project has Container Scanning disabled.
  2. The pipeline used a merge request pipeline instead of a branch pipeline.
  3. The runner had insufficient disk space for the cache.
  4. The job did not declare artifacts:reports:sast, so results were not ingested. Correct answer.

Explanation

GitLab only parses SAST results when the job publishes them under artifacts:reports:sast. Without that declaration the analyzer may run successfully but its findings never reach the security dashboard or merge request widget.

Question 11Application Security Testing

Which variable is commonly used to point the DAST job at the application under test?

  1. APP_ENDPOINT
  2. DAST_WEBSITE Correct answer.
  3. DAST_TARGET_HOST
  4. TARGET_URL

Explanation

DAST_WEBSITE specifies the URL that the DAST scanner crawls and attacks. Setting it correctly is required for the scan to reach the deployed application.

Question 12Application Security Testing

A security team wants to fail a merge request when a new critical vulnerability is introduced by SAST. Which mechanism enforces this?

  1. A merge request approval policy that requires approval when critical SAST findings exist Correct answer.
  2. Adding the SAST report to the cache
  3. Setting the SAST job's allow_failure to true
  4. Configuring the runner to use a privileged executor

Explanation

Merge request approval policies can require additional approvals when specified vulnerability severities are detected, blocking merge until the risk is reviewed. This is the governance layer that turns findings into a merge gate.

Question 13Application Security Testing

How does GitLab's Secret Detection reduce false positives for test fixtures that intentionally contain fake credentials?

  1. By automatically deleting the offending file
  2. By disabling scanning on the default branch
  3. By excluding files matched by configurable path exclusion rules Correct answer.
  4. By requiring manual approval before each scan

Explanation

Secret Detection supports exclusion rules so known test fixtures or example files can be skipped, reducing noise. Exclusions should be scoped narrowly to avoid masking real leaks.

Question 14Application Security Testing

A Dependency Scanning report lists a vulnerable version of a library that the project does not actually use at runtime. What is the most appropriate response?

  1. Delete the lock file from the repository
  2. Dismiss the finding as a false positive after verifying the dependency is not reachable Correct answer.
  3. Disable Dependency Scanning for the project
  4. Immediately upgrade the parent application to a new major version

Explanation

When a flagged dependency is confirmed unused or unreachable, dismissing the finding with a documented reason keeps the risk register accurate. Verification should precede dismissal so real exposure is not overlooked.

Question 15Application Security Testing

Which GitLab capability helps prioritize vulnerabilities based on whether the vulnerable code is actually reachable in the application?

  1. License scanning
  2. Coverage visualization
  3. Pipeline efficiency report
  4. Static reachability analysis Correct answer.

Explanation

Reachability analysis evaluates whether the vulnerable function or dependency path is actually invoked, which helps separate exploitable findings from theoretical ones. This reduces alert fatigue by elevating findings that matter.

Question 16Application Security Testing

What is the purpose of the GitLab security dashboard at the group level?

  1. To define CI/CD variables for all projects
  2. To manage license seats for developers
  3. To aggregate and track vulnerabilities across multiple projects in the group Correct answer.
  4. To configure runner autoscaling

Explanation

The group security dashboard consolidates findings from projects within a group, giving security teams a portfolio view of risk. It supports tracking trends and triage across many repositories.

Question 17Application Security Testing

A pipeline uses the SAST template, but the analyzer image cannot pull from the registry in an air-gapped environment. Which action resolves this?

  1. Switch the job to a shell runner without network access
  2. Remove the artifacts declaration
  3. Increase the job timeout
  4. Mirror the analyzer image to an internal registry and override the image reference Correct answer.

Explanation

In an air-gapped environment the analyzer images must be hosted in a reachable internal registry, and the job's image reference overridden to point there. This preserves scanning without external network access.

Question 18Application Security Testing

Which GitLab analyzer uses generated inputs to test API endpoints for crashes and unexpected behavior?

  1. Dependency Scanning
  2. API Fuzzing Correct answer.
  3. Container Scanning
  4. Secret Detection

Explanation

API Fuzzing sends generated and malformed requests to API operations described by a specification such as OpenAPI. It looks for crashes, timeouts, and anomalous responses that indicate robustness or security weaknesses.

Question 19Application Security Testing

A team wants vulnerability findings from the default branch to be tracked over time rather than duplicated per pipeline. Which GitLab behavior supports this?

  1. Vulnerability records are deduplicated and tracked across pipelines on the default branch Correct answer.
  2. Findings are only stored in job logs
  3. Each pipeline creates entirely new vulnerability records
  4. Findings are discarded after the pipeline finishes

Explanation

GitLab maintains vulnerability records that persist and are updated across scans on the default branch, so a recurring finding is tracked rather than recreated. This enables lifecycle states and historical tracking.

Question 20Application Security Testing

Which approach best reduces false positives from Secret Detection when a project legitimately contains placeholder tokens in documentation?

  1. Disable the analyzer for the entire group
  2. Lower the pipeline concurrency
  3. Add narrowly scoped exclusion rules for the documentation paths Correct answer.
  4. Convert the documentation to binary format

Explanation

Scoped path exclusions let the team skip known placeholder locations while keeping coverage elsewhere. Broad disabling would hide real secrets and weaken the control.

Question 21Application Security Testing

Why should Container Scanning run after the image build job in the pipeline?

  1. The scanner needs the built image reference to inspect its packages Correct answer.
  2. The scanner needs merge request approval before running
  3. Container Scanning only works on the default branch
  4. The scanner requires the SAST report first

Explanation

Container Scanning analyzes a specific image, so the image must exist and its reference be available before the scan job runs. Ordering the scan after the build ensures the correct artifact is inspected.

Question 22Application Security Testing

A SAST finding is marked as 'Detected' in one pipeline and 'Resolved' in the next after a fix. What drives this transition?

  1. The pipeline cache stores the previous result
  2. A developer manually edits the database record
  3. The runner automatically patches the source code
  4. The subsequent scan no longer reports the finding, so GitLab updates its lifecycle state Correct answer.

Explanation

GitLab compares scan results across runs on the default branch; when a previously detected finding is absent, its state moves to Resolved. This automatic lifecycle tracking reflects remediation without manual record editing.

Question 23Application Security Testing

A merge request approval policy is configured to block on high-severity findings, but developers report merges still succeed. Which cause is most plausible?

  1. The policy's scope or severity conditions do not match the project or finding severity Correct answer.
  2. The runner uses a Docker executor
  3. The project has too many branches
  4. The SAST analyzer is producing too many reports

Explanation

Approval policies only apply where their scope and severity conditions match, so a mismatched scope or threshold lets merges proceed. Verifying the policy's project linkage and severity settings is the first diagnostic step.

Question 24Application Security Testing

Which statement best explains why DAST may miss vulnerabilities that SAST detects in the same application?

  1. DAST only scans container images
  2. DAST requires source code access to function
  3. DAST only exercises reachable runtime paths, so code in untriggered branches is never tested Correct answer.
  4. DAST cannot detect injection flaws under any circumstance

Explanation

DAST is black-box and can only probe paths it can reach through the running application, so dormant or hard-to-reach code escapes testing. SAST inspects source directly and can flag issues in code paths DAST never triggers.

Question 25Application Security Testing

An organization wants to enforce that all projects run SAST with a mandated configuration regardless of project-level CI edits. Which GitLab mechanism is designed for this?

  1. A scan execution policy enforced at the group or project level Correct answer.
  2. A branch protection rule alone
  3. A project-level .gitlab-ci.yml override
  4. A runner tag restriction

Explanation

Scan execution policies let security teams mandate that specified scans run on defined schedules or triggers, independent of individual project CI configuration. This centralizes enforcement across many projects.

Question 26Application Security Testing

In GitLab Application Security, what distinguishes a SAST analyzer from a scanner that inspects a running web application over HTTP?

  1. The SAST analyzer inspects source code or build artifacts statically without executing the deployed application Correct answer.
  2. The SAST analyzer only reports dependency versions and never inspects first-party source files
  3. The SAST analyzer requires a live target URL supplied through DAST_TARGET_URL before it can run
  4. The SAST analyzer executes the application inside a container and records runtime stack traces

Explanation

Static Application Security Testing analyzes source code or compiled artifacts to find insecure patterns without running the deployed application, which is why it can run early in the pipeline. Dynamic analysis instead exercises a running target over the network. This distinction determines which findings each approach can realistically produce.

Question 27Application Security Testing

A project includes the GitLab SAST template but the resulting job produces a report with no findings even though the repository clearly contains vulnerable code. Which explanation is most consistent with how SAST analyzers select files?

  1. The analyzer only scans file types and languages it supports, so unsupported extensions are skipped Correct answer.
  2. The vulnerability database used by the analyzer was not refreshed before the pipeline ran
  3. The findings were written to the pipeline artifact but not to the security report JSON
  4. The merge request approval policy suppressed the findings before they were written to the report

Explanation

Each SAST analyzer supports a defined set of languages and file extensions, and files outside that set are not analyzed. When the codebase uses a language the selected analyzer does not cover, the job can succeed while reporting nothing. Confirming language support is therefore the first diagnostic step.

Question 28Application Security Testing

Which GitLab feature inspects the source repository history and working tree for hardcoded credentials such as API keys and private tokens?

  1. Secret Detection Correct answer.
  2. License Scanning
  3. Operational Container Scanning
  4. Container Scanning

Explanation

Secret Detection scans repository content for patterns that indicate committed credentials, such as API keys, tokens, and private keys. It is distinct from license compliance and from image-based scanning. Its findings are reported as vulnerabilities in the security report.

Question 29Application Security Testing

A team enables Dependency Scanning and wants the job to examine the resolved dependency graph rather than only manifest files. Which statement best describes how GitLab's dependency analyzers generally operate?

  1. They query the GitLab package registry for the latest published version of each dependency
  2. They run the application's test suite and observe which libraries are loaded at runtime
  3. They decompile the built container image and inspect every layer for package metadata
  4. They parse lock files and manifests to identify components and compare them against vulnerability data Correct answer.

Explanation

Dependency analyzers read manifests and lock files to build a component inventory, then match those components and versions against vulnerability data. This is why a committed lock file improves accuracy: it records resolved versions. Runtime observation and image layer inspection belong to other testing types.

Question 30Application Security Testing

A security engineer needs DAST to authenticate as a normal user so it can reach pages behind a login. Which GitLab DAST capability is intended for this?

  1. Providing a DAST_TARGET_URL that includes credentials in the query string
  2. Adding the credentials to the SAST analyzer configuration file
  3. Setting the credentials as a protected CI/CD variable named GIT_STRATEGY
  4. Configuring DAST authentication with a login form or authentication URL and credentials Correct answer.

Explanation

GitLab DAST supports authentication configuration that lets the scanner submit credentials to a login form or authentication endpoint, then reuse the resulting session. This allows it to crawl and test authenticated areas of the application. Embedding credentials in the target URL or unrelated variables does not establish a session.

Question 31Application Security Testing

A developer wants to run an on-demand DAST scan against a staging environment without waiting for the scheduled pipeline. Which GitLab capability supports this?

  1. A scheduled pipeline that runs only the Container Scanning job
  2. A manual SAST job that is triggered from the security dashboard
  3. On-demand DAST scans configured with a scan profile and site profile Correct answer.
  4. A merge request approval policy scoped to the staging environment

Explanation

On-demand DAST lets a user configure site and scan profiles and launch a scan outside the normal pipeline cadence. This is useful for validating a staging deployment before release. The profiles capture the target and the scan behavior separately.

Question 32Application Security Testing

A security analyst notices that a vulnerability reported by SAST on the default branch disappears from the vulnerability report after a subsequent pipeline. Which condition most directly explains the removal?

  1. The analyzer image was updated to a newer major version between pipelines
  2. The finding is no longer detected in the latest scan of the default branch and is marked resolved Correct answer.
  3. The project's vulnerability permissions were changed so the analyst lost visibility
  4. The pipeline ran on a feature branch and therefore overwrote the default branch results

Explanation

GitLab tracks findings across scans of the default branch; when a previously detected finding is absent from the latest scan, its state transitions toward resolved. Feature branch scans do not overwrite default branch tracking. Analyzer version changes alone do not silently delete tracked findings.

Question 33Application Security Testing

Which GitLab artifact is produced by a security analyzer job and consumed by GitLab to populate the vulnerability report and merge request widget?

  1. A JSON security report declared as a CI artifact Correct answer.
  2. A SARIF file attached to the release
  3. A JUnit XML test report
  4. A coverage report in Cobertura format

Explanation

Security analyzers emit a JSON report that is declared as an artifact; GitLab parses it to populate the vulnerability report and merge request widget. Without that artifact declaration, findings never reach the UI. Other report formats serve different features such as test results or coverage.

Question 34Application Security Testing

A team wants to prevent merging when Secret Detection finds a new critical secret in the merge request. Which GitLab mechanism is designed for this?

  1. A merge request approval policy that requires approval when the security scan finds a matching severity Correct answer.
  2. A protected branch configured to allow only maintainers to push
  3. A project setting that disables merge requests for the default branch
  4. A CI job rule that retries the Secret Detection job on failure

Explanation

Merge request approval policies evaluate security findings and can require approval before a merge proceeds when defined severity thresholds are met. This connects scanner output to the merge gate. Retries, disabled merge requests, and push restrictions do not act on findings.

Question 35Application Security Testing

Which statement best explains why GitLab recommends running Container Scanning after the image build job in the same pipeline?

  1. The scanner requires the build job's logs to determine which base image was used
  2. The scan only works when the image is pushed to an external registry first
  3. The scan must run before the build so that vulnerabilities are known in advance
  4. The scanner needs the image to exist and be referenced by tag or digest before it can inspect it Correct answer.

Explanation

Container Scanning inspects a built image, so the image must exist and be addressable by tag or digest before the scan runs. Ordering the job after the build ensures the scanner analyzes the artifact the pipeline just produced. The scanner reads image metadata directly rather than relying on build logs.

Question 36Application Security Testing

An organization wants consistent SAST coverage across hundreds of projects without editing each project's CI file. Which GitLab capability is designed for this?

  1. A shared runner tagged for security jobs
  2. A group-level CI/CD variable holding the SAST template path
  3. A project-level badge that displays the latest scan status
  4. Scan execution policies enforced through a security policy project Correct answer.

Explanation

Scan execution policies let a security team enforce scanner jobs across projects from a central policy project, independent of individual CI configuration. This provides consistent coverage and resists local drift. Runner tags, variables, and badges do not enforce job execution.

Question 37Application Security Testing

A SAST scan reports a SQL injection in a code path that is only reachable from a deprecated admin endpoint that is disabled in production. Which GitLab capability helps the team record that the risk is understood without deleting the finding?

  1. Changing the vulnerability status to Dismissed with a documented dismissal reason Correct answer.
  2. Disabling SAST for the entire project
  3. Lowering the project's severity threshold in the approval policy
  4. Deleting the pipeline that produced the finding

Explanation

Dismissing a vulnerability preserves the record while marking it as accepted or not applicable, and a dismissal reason documents the rationale for auditors. Deleting pipelines, disabling scanning, or weakening policy thresholds removes visibility rather than recording a decision.

Question 38Application Security Testing

A team uses the same SAST analyzer across two projects. In project A the analyzer reports a finding, while in project B the identical code pattern is not reported. Which factor is most likely to explain the difference?

  1. The projects have different analyzer configuration, such as rule sets or excluded paths Correct answer.
  2. Project A has more merge requests open than project B
  3. The two projects use different default branch names
  4. Project B has a faster runner that completes the job before analysis finishes

Explanation

Analyzer behavior can be tuned through configuration such as custom rule sets, excluded paths, or severity filters, so identical code can yield different results across projects. Branch naming, runner speed, and merge request volume do not change which patterns an analyzer reports. Comparing analyzer configuration is the productive diagnostic.

Question 39Application Security Testing

Which GitLab feature provides a merged view of vulnerabilities across all projects in a group so security leadership can track remediation trends?

  1. The project's CI/CD pipeline graph
  2. The group's merge request analytics page
  3. The repository's commit history graph
  4. The group-level security dashboard and vulnerability report Correct answer.

Explanation

Group-level security dashboards and vulnerability reports aggregate findings across projects, giving leadership a consolidated view for prioritization and trend tracking. Pipeline graphs, commit history, and merge request analytics describe delivery activity rather than security posture.

Question 40Application Security Testing

A security team enables both SAST and DAST for a web application. DAST reports no injection issues on an endpoint that SAST flags as vulnerable. Which explanation is most plausible?

  1. The endpoint returns HTTP 200, which prevents DAST from analyzing it
  2. DAST cannot detect injection flaws under any circumstances
  3. SAST findings always take precedence and suppress the corresponding DAST results
  4. The DAST scanner did not discover or exercise the vulnerable endpoint during its crawl Correct answer.

Explanation

DAST can only test inputs it can reach, so endpoints hidden behind authentication, unlinked from crawled pages, or requiring specific parameters may never be exercised. SAST sees the code regardless of reachability, which is why the two techniques complement each other. Coverage gaps, not a general inability, explain the discrepancy.

Question 41Governance & Compliance

Under GitLab's compliance framework model, what distinguishes a compliance framework from a compliance standard?

  1. A framework is defined per group, while a standard is defined per project
  2. A framework is enforced only by scanners, while a standard is enforced only by approval rules
  3. A framework is a paid-tier license feature, while a standard is available in the free tier
  4. A framework is a curated collection of controls that can be applied to projects, while a standard is a published regulatory text GitLab references Correct answer.

Explanation

GitLab models compliance frameworks as curated collections of controls that can be attached to projects to signal which regulatory or internal regime they fall under. Standards are the external published texts (for example SOC 2 or ISO 27001) that frameworks help map to, not a GitLab object type.

Question 42Governance & Compliance

A security specialist needs every project in a top-level group to inherit the same compliance framework automatically. What is the most appropriate GitLab mechanism?

  1. Creating a group-level compliance framework and enforcing it across the group's projects Correct answer.
  2. Applying the framework manually to each project through the project settings
  3. Adding a CI job that calls the compliance frameworks API for each project nightly
  4. Assigning the framework to each developer's personal namespace

Explanation

Compliance frameworks are created at the top-level group and can be applied to projects within that group, which is the supported way to standardize compliance posture across a hierarchy. Manual per-project application does not scale and is prone to drift.

Question 43Governance & Compliance

In GitLab compliance pipelines, what is the primary purpose of the `compliance_jobs` configuration?

  1. To replace the project's `.gitlab-ci.yml` entirely with a group-level file
  2. To inject mandatory jobs into project pipelines so they cannot be skipped or modified by project maintainers Correct answer.
  3. To schedule compliance scans on a cron basis independent of pipelines
  4. To define jobs that run only after a merge request is approved

Explanation

A compliance pipeline defined at the group level can include `compliance_jobs` so that designated jobs are always injected into the project's pipeline and cannot be removed by project-level edits. This enforces controls such as mandatory scanning regardless of the project's own CI configuration.

Question 44Governance & Compliance

A team wants merge requests targeting protected branches in a compliance framework project to require approval from a security team member. Which configuration achieves this?

  1. A CODEOWNERS file entry for the security team on all files
  2. A CI job that posts a comment reminding reviewers to check security
  3. A merge request approval rule scoped to the compliance framework that requires a member of the security group Correct answer.
  4. A protected branch setting that disables approvals for security members

Explanation

GitLab lets you attach merge request approval rules to a compliance framework, so projects with that framework automatically require the specified approvals. Scoping the rule to the framework keeps the control consistent across all projects that carry it.

Question 45Governance & Compliance

Which GitLab feature provides an auditable, tamper-evident record of group and project events for compliance evidence?

  1. The CI/CD job log retention setting
  2. The merge request approval history
  3. The audit events stream, including streaming to external destinations Correct answer.
  4. The repository's commit graph

Explanation

Audit events capture group and project activity, and GitLab supports streaming them to external destinations for tamper-evident retention. This makes them the primary source of compliance evidence for who did what and when.

Question 46Governance & Compliance

An auditor asks for proof that no one changed a protected branch's protection settings during the audit period. Which evidence source is most direct?

  1. The project's README change history
  2. Audit events filtered to protected branch setting changes Correct answer.
  3. The pipeline success rate dashboard
  4. The number of open merge requests

Explanation

Audit events record configuration changes such as modifications to protected branch settings, giving a direct, timestamped trail. Other artifacts do not capture administrative configuration changes.

Question 47Governance & Compliance

What does a GitLab security policy project do in the context of scan execution policies?

  1. It is the project that hosts the container registry for scanners
  2. It is a fork of the application used for penetration testing
  3. It is the repository where vulnerability findings are stored after triage
  4. It stores the YAML policy files that GitLab reads to enforce scan execution across linked projects Correct answer.

Explanation

Security policies are defined as YAML in a dedicated security policy project linked to a group or project. GitLab reads those policies to enforce scan execution and scan result policies on the linked projects.

Question 48Governance & Compliance

A scan execution policy is configured to run a SAST scan on every pipeline. A developer edits the project's `.gitlab-ci.yml` to remove the SAST job. What is the expected outcome?

  1. The SAST job runs only on the default branch
  2. The pipeline fails to start until the policy is disabled
  3. The SAST job is removed because project CI takes precedence
  4. The policy still enforces the SAST scan because policy-enforced jobs cannot be removed by project edits Correct answer.

Explanation

Scan execution policies are enforced by GitLab independently of the project's CI file, so removing a job from `.gitlab-ci.yml` does not disable a policy-mandated scan. This is the core value of policy-based enforcement over project-level configuration.

Question 49Governance & Compliance

Which statement correctly describes the difference between a scan execution policy and a scan result policy?

  1. Scan execution policies apply only to the default branch; scan result policies apply to all branches
  2. Scan execution policies act on findings; scan result policies define when scans run
  3. Scan execution policies define when scans run; scan result policies act on findings, such as requiring approval when a threshold is exceeded Correct answer.
  4. Both define when scans run, but scan result policies apply only to container scanning

Explanation

Scan execution policies control scheduling and enforcement of scanners, while scan result policies evaluate the findings and can require approvals or block merges based on severity thresholds. The two complement each other in a defense-in-depth policy setup.

Question 50Governance & Compliance

In a scan result policy, a rule triggers when a merge request introduces a critical vulnerability. Which action can the policy take?

  1. Automatically remediate the vulnerability by rewriting the source code
  2. Disable the pipeline for the merge request permanently
  3. Require additional approvals before the merge request can be merged Correct answer.
  4. Delete the vulnerable dependency from the repository

Explanation

Scan result policies can require approvals when findings meet defined criteria, enforcing human review before risky changes merge. They do not automatically rewrite code or delete dependencies.