Integrating RASP and VAPT in Release and Deploy DSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security architect is designing a defense-in-depth strategy for a web application. The application has been through multiple VAPT cycles, and the team has fixed all known critical vulnerabilities. However, the architect wants to add a control that provides a safety net for unknown vulnerabilities and zero-day exploits. The control must not require code changes and must be able to block attacks in real time. Which combination of controls is most effective?

   • ADeploy RASP in production and continue regular VAPT in the SDLC to identify and fix vulnerabilities before they are exploited.
   • BDeploy a WAF and rely on its signature updates to block zero-day exploits.
   • CUse only SAST and DAST in the pipeline and deploy without any runtime protection.
   • DIncrease the frequency of VAPT to weekly and stop using any runtime protection.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of a Vulnerability Assessment (VA) in the context of VAPT?

   • ATo actively exploit vulnerabilities to demonstrate business impact
   • BTo ensure compliance with all regulatory requirements automatically
   • CTo replace the need for penetration testing entirely
   • DTo identify, classify, and prioritize vulnerabilities in systems and applications
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SaaS company wants to run automated vulnerability scans against a staging environment that mirrors production. The scans must run every night, and critical findings must block the next morning's release. Which pipeline configuration best meets this requirement?

   • AUse a static analysis tool in the CI pipeline instead of a vulnerability scanner
   • BConfigure the scanner to run only in production after the release is deployed
   • CSchedule a nightly Jenkins job that runs the vulnerability scanner, posts results to the ticketing system, and sets a pipeline quality gate that fails if any critical issue is found
   • DRun the vulnerability scanner manually before each release and review the report in a meeting
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security engineer is comparing RASP and WAF for a new application. The application has complex business logic and handles sensitive user data. The team is concerned about false positives disrupting legitimate users. Which approach should they choose to minimize false positives while providing strong protection?

   • ADeploy RASP in monitoring mode initially, analyze the alerts, and then enable blocking rules for confirmed attack patterns
   • BUse only a network firewall and rely on the application's existing input validation
   • CDeploy both RASP and WAF with blocking enabled on both from day one
   • DDeploy a WAF with a strict rule set and enable blocking immediately
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a common method to automate RASP configuration and deployment in a CI/CD pipeline?

   • AConfiguring RASP only in the production environment and not in staging
   • BManually installing the RASP agent on each server after deployment
   • CUsing a separate ticketing system to track RASP agent installations
   • DUsing infrastructure-as-code templates to include the RASP agent and its configuration in the deployment manifest
   Reveal Solution Discussion Select an answer first