GitLab Security Specialist study guide
GitLab Security Specialist · Work through your exam, one topic at a time.
The GitLab Security Specialist credential is an independent, vendor-neutral exam designed for security engineers, DevSecOps practitioners, platform administrators, and compliance leads who want to validate their ability to harden a software factory built on GitLab and to let AI agents operate with earned autonomy without trading away security. The exam is delivered in English and is structured around five equally weighted domains: Application Security Testing, Governance & Compliance, Secrets Management, Supply Chain Security, and Visibility & Measurement. The GitLab Security Specialist study guide has 5 sections and about 1,960 words.
01Application Security Testing
Application Security Testing covers how GitLab's integrated scanners find flaws in code, dependencies, containers, running applications, and secrets. The exam expects you to match a scanner to its target, know how scanners are enabled in CI/CD, and understand how findings move from a pipeline report into merge request approvals and the vulnerability report.
411 words, about 2 min02Governance & Compliance
Governance & Compliance tests how GitLab enforces organizational rules and produces evidence. You need to distinguish frameworks, policies, approval rules, and audit data, and know which layer actually blocks a change.
402 words, about 2 min03Secrets Management
Secrets Management tests how credentials are stored, injected, masked, and detected in GitLab. The exam focuses on CI/CD variables, external secret managers, OIDC, and secret detection rather than generic password advice.
402 words, about 2 min04Supply Chain Security
Supply Chain Security tests how GitLab controls what enters your build: third-party dependencies, container images, licenses, and the evidence you keep about them. The exam distinguishes caching, scanning, and attestation.
363 words, about 2 min05Visibility & Measurement
Visibility & Measurement tests where security data appears, who can see it, and how to measure risk across projects. The exam expects you to choose the right view and understand its limits.
382 words, about 2 min