Visibility & Measurement
Visibility & Measurement tests where security data appears, who can see it, and how to measure risk across projects. The exam expects you to choose the right view and understand its limits.
Dashboards and reports
The vulnerability report lists findings for a project or group with severity, state, scanner, and location; you can filter and export. The security dashboard gives a group-level view of vulnerability trends and risk. The merge request security widget shows findings introduced by the change, which helps reviewers act before merge. The dependency list shows components and licenses. The compliance center summarizes framework status, and audit events record administrative actions.
Scope and permissions
A project dashboard covers one project; a group dashboard aggregates projects in that group. Access depends on role and tier: security features are largely Ultimate, and guests may see less than developers or security managers. The vulnerability report normally reflects the default branch, so a finding that exists only on a feature branch may not appear there until merged.
Measuring
Useful measures include counts by severity and state, age of open vulnerabilities, and trend over time. Dismissed findings should be reviewed for justification, not treated as fixed. Exporting or querying via the API supports external reporting, but the exported data is only as good as the scan coverage and branch scope behind it.
Worked example
A security manager needs the number of open Critical vulnerabilities across ten projects. They open the group vulnerability report, filter severity to Critical and state to Detected or Confirmed, and export the result. If they instead open one project's report, they see only that project. If the finding is on an unmerged branch, the default-branch report may omit it.
Traps
Do not confuse the vulnerability report with audit events: one shows security findings, the other shows actions. A group dashboard does not automatically include projects outside the group. Dismissing a vulnerability changes workflow state, not the underlying code. And a clean dashboard can mean missing scan coverage rather than a secure application.