Integrating RASP and VAPT in Release and Deploy DSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A DevOps team is using GitHub Actions for their CI/CD pipeline. They want to automate a DAST scan against a preview environment that is created for each pull request. The scan should run after the preview environment is ready and before the pull request is merged. Which GitHub Actions workflow configuration is correct?

   • ARun the DAST scan only on the main branch after the pull request is merged.
   • BUse a SAST tool instead of DAST to scan the source code in the pull request.
   • CAdd a job that runs after the preview environment deployment job, uses a DAST tool to scan the preview URL, and fails the workflow if critical findings are detected.
   • DRun the DAST scan in parallel with the preview environment deployment, so it completes faster.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A healthcare startup is preparing for a compliance audit and wants to validate that their patient portal is secure before the next release. They have limited budget and need to identify exploitable vulnerabilities in the deployed application, not just theoretical ones. Which approach should they prioritize?

   • ARun a software composition analysis (SCA) tool to check for outdated libraries
   • BConduct a penetration test against the staging environment using authenticated and unauthenticated test cases
   • CDeploy the application to production and monitor logs for attack attempts
   • DPerform a code review focusing on input validation logic
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company has a release pipeline that deploys to production multiple times per day. They want to run VAPT, but a full penetration test takes several hours and cannot run on every deployment. They also have a nightly vulnerability scan. What is the most effective way to balance security testing with the fast release cadence?

   • ARun a full penetration test on every deployment and accept the delay
   • BRun vulnerability scans only in production after deployment
   • CRun automated vulnerability scans on every deployment and schedule a full penetration test on a weekly or bi-weekly basis
   • DSkip vulnerability scans and only run penetration tests monthly
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In a CI/CD pipeline, what is the typical first step to integrate RASP into a containerized application?

   • AConfigure the RASP console to block all traffic before building the image
   • BAdd the RASP agent or library to the application image during the build stage
   • CDeploy the RASP agent as a separate sidecar container that connects to the application via a network socket
   • DRun a RASP vulnerability scan on the source code before compilation
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In a CI/CD pipeline, when should a vulnerability assessment be scheduled to provide the most value without slowing down development?

   • AOnly when a security incident occurs
   • BOnly during the annual security audit
   • COn a regular schedule (e.g., nightly) and also on release candidates before deployment
   • DAfter every commit to the main branch, as part of the continuous integration process
   Reveal Solution Discussion Select an answer first