Integrating RASP and VAPT in Release and Deploy DSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the software development lifecycle, when is a penetration test (PT) most appropriately conducted?

   • AAfter the application is deployed to production and has been stable for several months
   • BOnly after the application is retired from production
   • CDuring the requirements gathering phase to identify business risks
   • DIn a staging environment that mirrors production, before the final release
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A DevOps team wants to automate security testing in their Jenkins pipeline. They currently have a SAST job that runs on every commit. They now want to add a DAST scan against a deployed staging environment and a RASP configuration check before promoting the build to production. The pipeline must fail the build if critical findings are detected. Which pipeline design best achieves this?

   • AUse a single security stage that runs SAST, DAST, and RASP checks sequentially without any build-failure condition.
   • BAdd a pipeline stage after deployment to staging that runs DAST, then a stage that validates RASP configuration, and finally a gate that fails the build if either reports a critical finding.
   • CRun DAST only in the production environment after deployment, and use the results to create a ticket for the next sprint.
   • DRun DAST and RASP configuration checks in parallel with SAST on every commit, and fail the build if any test fails.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   After a release, the RASP console reports a spike in blocked SQL injection attempts against a new feature. The VAPT scan before release did not identify this vulnerability. What is the most appropriate response?

   • ARun another VAPT scan immediately and compare results
   • BInvestigate the blocked attempts, reproduce the issue in staging, and create a remediation ticket for the development team
   • CDisable the RASP rule to reduce false positives
   • DIgnore the alerts because RASP is blocking the attacks successfully
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a policy that all critical vulnerabilities must be fixed within 48 hours. A VAPT scan identifies a critical vulnerability in a legacy component that requires a vendor patch, which will take two weeks to arrive. The application is business-critical and cannot be taken offline. What is the most appropriate interim action?

   • ADeploy RASP with a blocking rule that mitigates the specific vulnerability while the vendor patch is developed
   • BDisable the affected feature until the patch is available
   • CAccept the risk and document that the patch is pending
   • DRun a second VAPT scan to confirm the vulnerability is still present
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which approach is commonly used to automate vulnerability scanning within a CI/CD pipeline?

   • AUsing a spreadsheet to track vulnerabilities found by external audits
   • BManually running the scanner on a developer's workstation before each commit
   • CRunning a vulnerability scanner as a separate step in the pipeline after the build stage
   • DDeploying the application first and then scanning the production environment
   Reveal Solution Discussion Select an answer first