GitLab Security Specialist study plan

Map the full GitLab application security testing feature set (SAST, DAST, dependency scanning, container scanning, secret detection, IaC scanning, API fuzzing, coverage-guided fuzzing, license scanning) to pipeline stages and job templates, writing a one-page comparison table.

Configure a working .gitlab-ci.yml in a scratch project that includes at least four security templates and produces artifacts and JSON reports on a merge request pipeline.

Explain how analyzer images, rules, and CI/CD variables control which scanners run on which branches, and document three configuration patterns you tested.

Identify which scanners require GitLab Ultimate versus lower tiers and record the tier gating for each.

Tune scanner behavior by writing custom rulesets: a Semgrep-based SAST ruleset override and a dependency-scanning exclusion/allowlist configuration.

Configure merge request approval policies so a new critical vulnerability blocks merge, and verify the block by introducing a deliberate finding.

Set up vulnerability management workflow states (Detected, Confirmed, Dismissed, Resolved) and practice dismissing a false positive with a documented reason.

Compare pipeline-based scanning against on-demand and scheduled scans, and note when each is appropriate.

Enable and configure secret detection (pipeline and push protection modes) and explain the difference in detection timing and coverage.

Demonstrate at least two remediation paths for a leaked credential: revoke-and-rotate versus Git history rewrite, and document the tradeoffs.

Integrate an external secrets manager pattern (for example CI/CD external secrets or OIDC-based cloud auth) so no long-lived credentials live in project variables.

Classify project, group, instance, and protected CI/CD variables by exposure risk and write masking/protection rules for each class.

Configure compliance frameworks and compliance pipelines at the group level and attach them to a test project.

Enforce at least three controls through compliance frameworks: MR approval rules, separation of duties, and mandatory scanners.

Audit the audit events stream and API for credential-related actions, and export a filtered report.

Map GitLab controls to a control framework you know (for example SOC 2 or ISO 27001) for the secrets and change-management areas.

Configure dependency scanning and container scanning with SBOM generation, and produce both CycloneDX and SPDX artifacts.

Set up license compliance policies with an allowlist/denylist and verify a disallowed license blocks the pipeline.

Explain and test dependency proxy and package registry controls, including how to prevent dependency confusion.

Configure signed container image verification or image allowlisting so only approved registries deploy.

Implement a vulnerability management SLA process: define severity-based remediation targets and track them via the vulnerability report API.

Build a dashboard or saved report that shows open vulnerabilities by severity, scanner, and project over time.

Configure security training or vulnerability explanation features and evaluate their usefulness for a developer audience.

Measure scanner coverage across a group: which projects have SAST, secret detection, and dependency scanning enabled, and which do not.

Define three security KPIs (for example mean time to remediate, scanner coverage percentage, secret leak recurrence) and compute each from real or sample data.

Configure merge request approval analytics and security posture dashboards, and interpret what each metric does and does not tell you.

Run a tabletop review of an audit trail: reconstruct who changed a protected branch setting and when, using audit events.

Draft a one-page executive summary translating technical metrics into risk statements.

Re-run every hands-on lab from weeks 1-7 in a clean project to confirm reproducibility.

Complete timed practice sets weighted 20% per domain and log every missed item with its root cause.

Review weak areas identified in practice and re-read only those feature areas.

Write a one-page exam-day reference sheet of tier gating, scanner defaults, and policy behaviors from memory, then verify it.