Integrating RASP and VAPT in Release and Deploy DSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An e-commerce platform has a quarterly VAPT program that identifies and fixes vulnerabilities before they reach production. However, a recent zero-day exploit in a third-party library was successfully used against the production application before the next quarterly test could be scheduled. The security team wants to add a control that can detect and block exploitation attempts at runtime without requiring a code change or a new deployment. Which control best addresses this gap?

   • ADeploy a RASP agent to the production application servers and configure it to monitor and block exploit patterns in real time.
   • BAdd a Web Application Firewall (WAF) rule to block all requests containing the library's name in the User-Agent header.
   • CIncrease the frequency of VAPT from quarterly to monthly and add more test cases to cover third-party libraries.
   • DSchedule an emergency penetration test immediately after the zero-day is disclosed and deploy a hotfix based on the findings.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is deploying a Java application to a Tomcat server. They want to integrate RASP into their deployment process. The RASP agent is available as a Java agent JAR file. Which deployment step is correct?

   • AModify the application's source code to include the RASP agent as a library.
   • BInstall the RASP agent as a standalone service on the server and configure it to monitor the Tomcat process.
   • CAdd the RASP agent JAR to the application's classpath and configure the JVM to load it with the -javaagent flag.
   • DPlace the RASP agent JAR in the Tomcat lib directory and restart Tomcat.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A government agency is developing a new citizen services portal. The project manager wants to ensure that security testing is integrated throughout the SDLC, not just at the end. The team has a CI/CD pipeline that deploys to a staging environment. Which VAPT approach best aligns with a DevSecOps culture?

   • ARun automated vulnerability scans and penetration tests as part of the CI/CD pipeline on every build deployed to staging.
   • BConduct a single comprehensive penetration test just before the final production release.
   • COutsource all security testing to an external vendor and review the report at the end of the project.
   • DPerform vulnerability scans only on the production environment after each release.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security analyst is reviewing the results of a VAPT scan. The scan found a critical SQL injection in a legacy admin panel that is only accessible from the internal network, and a high-severity cross-site scripting (XSS) vulnerability in the public-facing customer portal. The team has limited development resources and can only fix one issue before the next release. Which issue should be prioritized?

   • ABoth issues, because all findings must be fixed before the release, regardless of resource constraints.
   • BThe SQL injection in the internal admin panel, because SQL injection is always more severe than XSS.
   • CThe XSS in the public-facing customer portal, because it is accessible to external attackers and has a higher likelihood of exploitation.
   • DNeither issue, because VAPT findings are only recommendations and can be addressed in the next sprint.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A software company wants to integrate VAPT into their release pipeline. They have a staging environment that is only available during business hours. The team wants to run a full vulnerability scan and a basic penetration test before each production release. What is the most practical scheduling approach?

   • ASchedule the VAPT job to run every hour in the staging environment
   • BRun the VAPT job only in production after the release is complete
   • CTrigger the VAPT job automatically when a release candidate is promoted to staging, and require it to pass before the release proceeds
   • DRun the VAPT job manually on the first day of each month regardless of release schedule
   Reveal Solution Discussion Select an answer first