Integrating RASP and VAPT in Release and Deploy DSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When a vulnerability is found by a scanner in a release candidate, what is the first step in the triage process?

   • AAssign a severity rating and determine the potential impact on the system
   • BNotify the development team and ask them to fix it without further analysis
   • CImmediately deploy the release to production to avoid delays
   • DDelete the vulnerability report and continue with the release
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A large organization deploys a containerized application across multiple Kubernetes clusters. They want to integrate RASP but have a constraint: the RASP agent must not be baked into the base image because the image is shared with other teams that do not require RASP. They also need to ensure the agent is configured with environment-specific API keys. What is the best approach?

   • AInstall the RASP agent manually on each node in the Kubernetes cluster
   • BUse a Kubernetes admission controller to inject the RASP agent as an init container and pass environment-specific configuration via a ConfigMap
   • CCreate a new base image that includes the RASP agent and require all teams to use it
   • DUse a sidecar container that runs the RASP agent and communicates with the application via a Unix socket
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A software company is evaluating security controls for a new microservices-based application. They want a control that can identify and block attacks that exploit business logic flaws, such as unauthorized privilege escalation, which are difficult to detect with signature-based tools. The control must also provide visibility into the application's runtime behavior. Which control is most appropriate?

   • AA static application security testing (SAST) tool that scans source code for vulnerabilities.
   • BA network-based Intrusion Detection System (IDS) that inspects traffic for known attack signatures.
   • CA Web Application Firewall (WAF) configured with OWASP Core Rule Set.
   • DRuntime Application Self-Protection (RASP) that monitors application behavior and blocks anomalous actions.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is deploying a new application and wants to integrate RASP into the release pipeline. They have a policy that all security controls must be validated before production deployment. The RASP agent requires a license key that is different for each environment. What is the best way to manage this in the pipeline?

   • AHardcode the license key in the application source code
   • BStore the license keys in a secrets management tool and inject them as environment variables during the deployment step for each environment
   • CStore the license key in a configuration file that is committed to the repository
   • DUse the same license key for all environments to simplify the process
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A startup is developing a new SaaS product and wants to implement VAPT as part of their SDLC. They have a small team and a limited budget. They want to identify vulnerabilities early and often without overburdening the developers. Which VAPT strategy is most appropriate for their situation?

   • AOutsource VAPT to a third-party vendor and only review the report at the end of each quarter.
   • BPerform a comprehensive manual penetration test only once, just before the initial product launch.
   • CIntegrate automated vulnerability scanning into the CI/CD pipeline and schedule manual penetration tests for major releases.
   • DRely solely on SAST tools and skip DAST and manual testing to save time.
   Reveal Solution Discussion Select an answer first