Integrating RASP and VAPT in Release and Deploy DSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the recommended way to handle a high-severity vulnerability discovered by RASP in a production application?

   • AWait for the next scheduled release cycle to fix it
   • BCreate a remediation ticket, prioritize it based on severity, and apply a hotfix or configuration change as soon as possible
   • CIgnore it because RASP is blocking the attack
   • DImmediately shut down the application and wait for a full code review
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A DevOps engineer is setting up a CI/CD pipeline for a Node.js application. The team wants to automate security testing, including a DAST scan against a deployed test environment and a check that RASP is properly configured. The pipeline should stop the release if any high-severity issue is found. Which pipeline configuration is correct?

   • ARun only RASP configuration checks in the pipeline and rely on the RASP agent to protect the application.
   • BRun DAST in production after deployment and use the results to create a ticket for the next sprint.
   • CRun DAST and RASP configuration checks before the build step, and fail the pipeline if any issue is found.
   • DDeploy to a test environment, run DAST, verify RASP configuration, and then use a script to fail the pipeline if high-severity findings exist.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A healthcare SaaS provider releases a new patient-portal module every two weeks. Compliance requires that all externally accessible endpoints are penetration tested before production deployment. The release pipeline currently runs unit and integration tests but has no security gate. The team has a limited budget and cannot afford a full manual penetration test for every release. Which approach satisfies the compliance requirement while keeping the pipeline efficient?

   • ADeploy to production first and schedule a penetration test within 30 days after the release, as allowed by the compliance framework.
   • BRun an automated DAST scan against the staging environment as a pipeline stage, and require a manual penetration test only for major version releases.
   • CRun only SAST on the source code and consider the compliance requirement satisfied because static analysis finds all vulnerabilities.
   • DPerform a full manual penetration test on every release, regardless of change size, and block the pipeline until the report is approved.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company has a release pipeline that deploys to production every two weeks. They want to run a full VAPT (vulnerability scan + penetration test) before each release, but the penetration test takes three days to complete and requires a dedicated testing window. The staging environment is shared with development teams and cannot be locked down for three days. What is the best way to meet the VAPT requirement?

   • AProvision a separate, isolated staging environment specifically for VAPT and schedule the penetration test to run there during the release window
   • BRun the vulnerability scan in the shared staging environment and skip the penetration test to save time
   • CAsk the development team to pause their work for three days so the shared environment can be used
   • DRun the penetration test in production after the release is deployed
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   How do RASP and VAPT complement each other in a DevSecOps environment?

   • ARASP replaces the need for VAPT because it blocks all attacks
   • BVAPT identifies vulnerabilities before deployment, while RASP provides real-time protection after deployment
   • CVAPT is only useful after a security breach, while RASP is only useful before deployment
   • DRASP and VAPT both operate at the network layer and provide identical security controls
   Reveal Solution Discussion Select an answer first