Plan Matchup
A customer wants organization-wide vulnerability management, stronger security governance, and value stream visibility across projects. Which core plan is the best starting point: Premium or Ultimate?
Ultimate. It is positioned for advanced security, compliance, and value stream management.
True or False: Basic SAST scanning can be used in only Premium and Ultimate.
False, basic SAST scanning can be used in Free, Premium, and Ultimate.
True or False: GitLab CI/CD is available as part of the GitLab DevSecOps platform and is not restricted only to Ultimate.
True. GitLab plans include CI/CD capabilities; plan differences affect limits and advanced capabilities.
True or False: GitLab Duo Agent Platform is limited to autocomplete and code suggestions inside an IDE.
False. DAP uses agents and flows across the software development lifecycle, including planning, code review, security, CI/CD, and research tasks.
True or False: GitLab Dedicated is single-tenant SaaS managed by GitLab, while GitLab Self-Managed is installed and maintained on customer infrastructure.
True
True or False: Premium is designed for scaling development teams and includes advanced repositories, streamlined code reviews, integrated project management, and enhanced CI/CD.
True
A team can generate a SAST JSON artifact but wants new findings shown in merge requests, a vulnerability report, and tracked over time. Which tier should they evaluate?
Ultimate. Those richer reporting and vulnerability-management capabilities are part of the Ultimate security experience
A customer wants to restrict who can deploy to production. What GitLab capability should they investigate?
Protected environments. They safeguard testing and production environments by restricting deployment access to authorized users.
A customer wants to automate code refactoring, security analysis, pipeline troubleshooting, and issue-to-merge-request work. What is the strongest product match?
GitLab Duo Agent Platform
A customer wants the fastest path to a managed, multi-tenant SaaS experience with minimal infrastructure responsibility. Which deployment option is the natural starting point?
GitLab.com SaaS. Confirm data residency, networking, administration, and compliance requirements before finalizing the recommendation.
A Premium customer already has basic scanners but now wants centralized vulnerability management, findings surfaced in merge requests, security approvals, custom scanner rulesets, and organization-wide security governance. Which plan should they evaluate, and why?
Ultimate. The differentiator is not simply running a scan; it is the management, workflow, policy, and governance layer around security findings.
GitLab Advanced SAST is available in Free and Premium, with Ultimate offering only a reporting upgrade.
False. GitLab Advanced SAST is an Ultimate-only capability; Free and Premium provide basic SAST scanning
A development team wants a merge request to require multiple approvals before merge. What capability should they investigate, and which plans commonly support it?
Multiple approvers in code review; investigate Premium or Ultimate availability for the customer’s deployment model and version.
A customer on Ultimate already has Duo Pro for IDE code suggestions and chat. They now want event-triggered, multi-step automation that can plan work, modify files, fix pipelines, and use pooled consumption instead of assigning another AI seat. Which product should they evaluate, and how does it differ from Duo Pro?
GitLab Duo Agent Platform. DAP provides agentic agents and flows across the SDLC and uses GitLab Credits for usage-based consumption, while Duo Pro is a seat-based add-on for non-agentic capabilities such as Code Suggestions and Chat
True or False: GitLab Dedicated is a customer-installed version of GitLab that the customer must patch and operate on its own infrastructure.
False. GitLab Dedicated is a single-tenant SaaS solution deployed and maintained by GitLab.
True or False: Basic SAST, Secret Detection, and Container Scanning are completely unavailable outside Ultimate.
False. Basic scanning is available across tiers; Ultimate adds enterprise-grade scanning, management, workflow, and governance capabilities.
A regulated customer needs security approval rules for merge requests, customizable SAST and Secret Detection rulesets, and Container Scanning CVE allowlists. Which plan aligns to that requirement?
Ultimate
A customer has a multi-project release process and wants to validate the combined result of changes, sequence dependent merge requests, and protect the target branch from integration problems. Which GitLab CI/CD capabilities should they evaluate?
Merged Results Pipelines, Merge Trains, and Merge Request Dependencies. Together, these capabilities address combined-change validation, sequencing, and dependency-aware coordination.
A customer wants a central catalog for agents and flows, custom agents aligned to internal standards, external agent integrations, and policy-driven controls. What DAP capabilities should you discuss?
AI Catalog, custom agents, custom flows, external agents or MCP integrations, and governance controls.
A public-sector customer needs a managed, single-tenant environment with government-focused compliance requirements and reduced infrastructure overhead. Which deployment should be evaluated?
GitLab Dedicated for Government. Validate the customer’s required authorization, region, networking, and feature availability.
A Free-tier customer wants classic, non-agentic GitLab Duo Code Suggestions and Chat. Can they simply enable those features without changing the plan or purchasing an add-on?
No. The non-agentic Duo feature set requires Premium or Ultimate plus an available Duo add-on such as Duo Pro or Duo Enterprise
A regulated organization applies a compliance label to projects from a top-level group and wants that framework to enforce compliance pipeline configuration and security policies across those projects. What Ultimate capability is the best answer?
Compliance Frameworks, with enforcement of compliance pipelines and security policies in Ultimate
A team wants an AI workflow that analyzes a failed pipeline, identifies the likely root cause, and generates a fix in a new merge request. What GitLab product direction best fits?
GitLab Duo Agent Platform, using agentic capabilities such as pipeline diagnosis and repair flows.
True or False: GitLab Duo Pro and GitLab Duo Enterprise consume GitLab Credits in the same usage-based way as DAP.
False. Duo Pro and Duo Enterprise are seat-based add-ons and are not billed based on DAP usage or charged against GitLab Credits; DAP uses GitLab Credits for usage-based consumption.
A Self-Managed customer needs private or on-premise models for some Duo features but wants GitLab-managed models for others. What architecture does this describe?
A hybrid AI Gateway and model configuration: self-hosted infrastructure for selected features and GitLab-managed models for others