GitLab Certified Security Associate

Last checked November 10, 2026 against the official GitLab exam page.

1. Question 1SAST

   A team wants GitLab SAST to skip a vendored third-party directory that contains code they do not maintain, without turning off SAST for the whole project. Which approach fits best?

   1. AAdd the vendored directory to the SAST excluded paths setting so the analyzers skip it
   2. BDisable the SAST template entirely and run a separate third-party scanner on the rest of the repository
   3. CDelete the vendored directory from the repository before each pipeline runs and restore it afterwards
   4. DDismiss every finding that originates from the vendored directory in the Vulnerability Report
   Show answer and explanationHide answer

   Correct answer: A

   The SAST excluded paths setting (SAST_EXCLUDED_PATHS) tells the analyzers to skip matching files while the rest of the project is still scanned. Disabling the template removes coverage for all code, deleting the directory on every run is fragile, and dismissing findings still runs the analysis on that code.

2. Question 2Security Policies

   What does a scan execution policy do in GitLab?

   1. AIt runs container image scans on a fixed schedule outside of any pipeline in the project
   2. BIt blocks a merge request from merging until a named approver signs off on the proposed change in the review
   3. CIt stores scanner credentials in a protected variable that the scan jobs can read at runtime
   4. DIt requires specified security scans to run in in-scope project pipelines regardless of local CI settings
   Show answer and explanationHide answer

   Correct answer: D

   Scan execution policies enforce that defined security scans run in the pipelines of the projects they apply to, so project-level CI settings cannot simply switch them off. The other options describe approval rules, credential storage, and scheduled container scanning, which are not what scan execution policies do.

3. Question 3Container Scanning

   A team builds a Docker image in a pipeline and wants the image checked for operating system package vulnerabilities before it is pushed to production. Which approach fits?

   1. AInclude the Container Scanning template and point its scan at the image that the build job produced
   2. BEnable DAST so it sends requests to the running container and reports any vulnerable packages found
   3. CEnable Secret Detection, which inspects the operating system package versions in each image layer
   4. DRun License Compliance against the Dockerfile to list the packages that the base image installs
   Show answer and explanationHide answer

   Correct answer: A

   The Container Scanning template analyzes a container image for known operating system package vulnerabilities, and it can be pointed at the image the build produces. DAST tests running applications, Secret Detection looks for credentials, and License Compliance reports license information rather than package vulnerabilities.

4. Question 4DAST

   What is the main difference between passive and active DAST scanning?

   1. APassive scanning observes responses without sending attack payloads, while active scanning sends attack payloads to the target
   2. BPassive scanning runs only on merge requests, while active scanning runs only on the default branch of the project
   3. CPassive scanning requires credentials for the target, while active scanning never needs any form of authentication
   4. DActive scanning reads the application source code, while passive scanning only inspects running container images
   Show answer and explanationHide answer

   Correct answer: A

   Passive scanning inspects traffic and responses without sending attack payloads, so it is gentler on a target, while active scanning sends attack payloads and can change data. The other options invent run locations, authentication rules, or inputs that do not match how DAST works.

5. Question 5Dependency Scanning

   What is a software bill of materials (SBOM)?

   1. AA record of every merge request approval that was given during a single development sprint
   2. BA list of developers who are approved to merge changes into the protected branches of a project
   3. CAn inventory of the components and their versions that make up a software product or build
   4. DA set of firewall rules that restrict which outbound destinations build runners may contact
   Show answer and explanationHide answer

   Correct answer: C

   An SBOM lists the components, versions, and related metadata that a software product is built from, which helps teams find affected packages when a new advisory appears. The other options describe reviewer lists, approval records, and network rules rather than a component inventory.