Integrating RASP and VAPT in Release and Deploy DSE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A financial services company is required by regulation to perform a penetration test annually. They also want to integrate security testing into their CI/CD pipeline. The compliance team insists that the annual penetration test must be performed by an independent third party. How should the company reconcile these requirements?

   • AReplace the annual third-party test with automated VAPT scans in the pipeline
   • BKeep the annual third-party penetration test for compliance and add automated VAPT scans in the CI/CD pipeline for continuous testing
   • CUse the results from the CI/CD VAPT scans to satisfy the annual compliance requirement
   • DPerform the annual penetration test internally and use the results for both compliance and pipeline feedback
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security architect is evaluating runtime protection for a legacy Java application that cannot be modified. The application processes sensitive data and has a history of injection vulnerabilities. Which control provides the most direct protection against injection attacks at runtime?

   • AUse a web application firewall (WAF) with a rule set for OWASP Top 10
   • BEnable database-level auditing to log all queries for later review
   • CPlace a network firewall in front of the application to restrict access to trusted IP addresses
   • DDeploy a RASP agent that instruments the application's database queries and blocks malicious input patterns
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team is debating whether to invest in RASP or expand their VAPT program. The application is a legacy system that is difficult to change and has a history of vulnerabilities. The team has a limited budget and must choose one. The application is critical and cannot afford downtime. Which option provides the best risk reduction for this scenario?

   • AInvest in RASP, because it provides immediate runtime protection without requiring code changes and can block attacks on the legacy system.
   • BExpand the VAPT program to include more frequent and deeper testing, and fix all findings.
   • CDecommission the legacy system and replace it with a modern application.
   • DInvest in both RASP and VAPT, even though the budget is limited.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of Runtime Application Self-Protection (RASP) in a deployed application?

   • ATo encrypt all network traffic between the application and its users
   • BTo scan source code for vulnerabilities before deployment
   • CTo detect and block attacks in real time from within the application runtime
   • DTo replace the need for a web application firewall (WAF) entirely
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which deployment step is essential after adding a RASP agent to an application to ensure it functions correctly in production?

   • ADisable the RASP agent in production to avoid performance impact
   • BRemove all logging from the application to reduce noise
   • CConfigure the RASP agent with the correct application context and security policies
   • DEnsure the RASP agent is only installed on development environments
   Reveal Solution Discussion Select an answer first