Integrating RASP and VAPT in Release and Deploy DSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A retail company has a mobile app backend that is updated weekly. The security team wants to perform a penetration test on the new API endpoints before they go live. The team has a staging environment that mirrors production. The release manager is concerned about the time a full penetration test takes. Which strategy balances security and release velocity?

   • ARun automated DAST on the staging environment for every release, and schedule a manual penetration test quarterly or for major changes.
   • BRun a manual penetration test on every release, even if it delays the release by several days.
   • CSkip penetration testing for minor releases and only test major version upgrades.
   • DPerform a penetration test on the production environment after the release and roll back if issues are found.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A financial services company is required to perform a penetration test on its online banking application before every major release. The release cycle is six months. The security team wants to ensure the test is comprehensive and covers all critical assets. Which approach best ensures the penetration test is effective?

   • ADefine a detailed scope that includes all externally accessible endpoints, APIs, and authentication mechanisms, and use both automated and manual testing techniques.
   • BTest only the new features added in this release, as the rest of the application was tested previously.
   • CRun a quick automated vulnerability scan and consider it a penetration test.
   • DPerform the penetration test after the release to avoid delaying the deployment.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A DevOps team runs automated VAPT scans in their CI pipeline. The scanner reports 50 findings: 2 critical, 8 high, 15 medium, and 25 low. The release manager wants to proceed with the release today. Which action is most appropriate?

   • ABlock the release until all 50 findings are remediated
   • BBlock the release and require remediation of the critical and high findings before allowing the pipeline to continue
   • CAllow the release and schedule remediation for the next sprint
   • DAllow the release but require the team to document the findings in a risk register
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which statement best distinguishes RASP from a traditional web application firewall (WAF)?

   • ARASP operates from within the application runtime, while a WAF inspects traffic at the network edge
   • BRASP requires a separate hardware appliance, while a WAF is software-only
   • CRASP only detects vulnerabilities, while a WAF only blocks attacks
   • DRASP is a network-level security control, while a WAF is an application-level control
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Why is RASP considered a valuable complement to penetration testing even after a successful penetration test?

   • ABecause RASP automatically fixes the vulnerabilities found during the penetration test
   • BBecause RASP can block zero-day attacks that were not known during the penetration test
   • CBecause RASP provides a detailed report of all vulnerabilities in the application code
   • DBecause RASP eliminates the need for future penetration tests
   Reveal Solution Discussion Select an answer first