Application Security Testing
Application Security Testing covers how GitLab's integrated scanners find flaws in code, dependencies, containers, running applications, and secrets. The exam expects you to match a scanner to its target, know how scanners are enabled in CI/CD, and understand how findings move from a pipeline report into merge request approvals and the vulnerability report.
Scanner-to-target map
- SAST analyzes source code with language-specific analyzers. It does not execute the application.
- Dependency Scanning inspects manifests and lockfiles for known vulnerabilities in open-source libraries.
- Container Scanning inspects container images, including OS packages and installed dependencies.
- DAST probes a deployed application over HTTP; it needs a target URL or an API specification.
- Secret Detection scans repository history and commits for credentials and tokens.
- Fuzzing sends generated inputs to find crashes and unexpected behavior.
Enabling and tuning
Scanners are normally enabled by including a GitLab-provided CI template, for example include: - template: Security/SAST.gitlab-ci.yml, or by attaching a scan execution policy at group or project level. Templates create jobs that produce report artifacts; the artifacts populate the merge request widget and vulnerability report. Tune scope with variables such as SAST_EXCLUDED_PATHS, SAST_EXCLUDED_ANALYZERS, and DAST_WEBSITE. Many scanners are Ultimate features, so a Premium-only project will not show the same results.
Worked example
A team wants critical SAST findings to require approval before merge. They include the SAST template so the sast job runs on merge request pipelines, confirm the report artifact appears in the MR widget, then create a merge request approval policy scoped to the project with a rule that requires approval when a SAST finding of Critical severity exists. The scanner detects; the policy enforces. Adding the template alone does not block anything.
Traps
Do not confuse SAST with DAST: SAST reads code, DAST attacks a running app. Dependency Scanning is not License Compliance. Secret Detection reports exposed credentials but does not rotate them. A scan execution policy enforces that a scan runs; it does not by itself require an approval. Finally, a finding in a feature branch may not appear in the default-branch vulnerability report until merged.