Integrating RASP and VAPT in Release and Deploy DSE Practice Questions (Page 9)

Questions 41–43

1. 41application · medium

   A security team is designing a defense-in-depth strategy for a web application. They want to identify vulnerabilities before release and also protect against unknown attacks after deployment. Which combination of controls best achieves this?

   • ADeploy RASP in staging and run VAPT only in production
   • BRun VAPT in production and rely on network monitoring for runtime protection
   • CRun VAPT in the staging environment and deploy RASP in production
   • DUse only a WAF in production and skip VAPT
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A DevOps team is building a CI/CD pipeline for a serverless application. They want to automate RASP and VAPT, but the application is deployed as a set of AWS Lambda functions. Which approach is most appropriate for this environment?

   • ARun VAPT only on the source code before deployment
   • BUse a traditional RASP agent that requires a virtual machine or container
   • CSkip VAPT because serverless applications are inherently secure
   • DRun VAPT against the deployed Lambda functions in a staging environment and use a RASP solution that supports serverless runtimes
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   A security team has automated VAPT scans in the CI pipeline. The scans produce a large number of findings, and the development team is overwhelmed, leading to security debt. The team wants to reduce the noise and focus on actionable findings. What is the most effective strategy?

   • ARequire the development team to fix every finding, regardless of severity
   • BDisable the automated scans and rely on manual penetration tests
   • CIncrease the scan frequency to catch more issues
   • DTune the scanner to suppress known false positives and prioritize findings based on exploitability and business impact
   Reveal Solution Discussion Select an answer first