Runtime Application Self-Protection (RASP) ECDE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is investigating a potential data breach. RASP logs show that a specific endpoint was targeted with a command injection payload, but the logs do not show whether the attack was blocked or if the command was executed. The application was running with RASP in monitoring mode at the time. What is the most important limitation of the RASP logs in this investigation?

   • ARASP logs are encrypted and cannot be read by the security team.
   • BRASP logs only show the last 24 hours of activity.
   • CMonitoring mode only logs the detection, not whether the attack was actually blocked or if the command executed.
   • DRASP logs do not include the source IP address of the attacker.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A DevSecOps team is deploying a containerized Java microservice to a Kubernetes cluster. The security team wants runtime protection against SQL injection and deserialization attacks that bypass the existing network-layer WAF. The team needs visibility into attack attempts without requiring changes to the application code or container image. Which approach best meets these requirements?

   • ADeploy an agent-based RASP that attaches to the JVM at container startup via an init container or sidecar.
   • BConfigure Kubernetes NetworkPolicies to restrict traffic to the microservice from known internal IPs only.
   • CPlace a WAF instance in front of the Kubernetes ingress to inspect all HTTP traffic.
   • DEmbed a RASP library directly into the application source code and recompile the service.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is evaluating RASP for a new application. The application handles sensitive data and is subject to strict compliance requirements. The analyst wants to know which types of attacks RASP can detect that a WAF cannot. Which attack type is best detected by RASP because it requires visibility into the application's internal logic?

   • AA distributed denial-of-service (DDoS) attack that floods the network with traffic.
   • BSQL injection that is obfuscated and only becomes a malicious query after the application processes the input.
   • CA cross-site scripting (XSS) attack that is encoded in the URL and reflected in the response.
   • DA brute-force attack on the login page that sends many requests with different passwords.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company has both a WAF and RASP deployed for their web application. A security analyst notices that the WAF is blocking a legitimate API request because it contains a pattern that resembles SQL injection. The analyst wants to understand the difference in how WAF and RASP would handle this request. Which statement is correct?

   • AThe WAF and RASP both use the same signature-based detection and would both block the request.
   • BThe WAF blocks the request based on the payload pattern, while RASP would evaluate the request in the context of the application's SQL query execution.
   • CThe WAF is more accurate than RASP because it sees the raw request before the application processes it.
   • DRASP would block the request because it has the same visibility as the WAF.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A software vendor sells a commercial Java application that customers deploy on their own infrastructure. The vendor wants to offer runtime security protection to customers without requiring them to modify the application or rebuild it. The vendor also wants to minimize the performance overhead on customer systems. Which RASP deployment approach is most appropriate?

   • ADeploy a network-based WAF appliance in front of each customer's application.
   • BEmbed RASP directly into the application's source code before compilation.
   • CProvide an agent-based RASP that customers attach to the JVM using the -javaagent flag.
   • DRequire customers to run the application in a container with RASP baked into the image.
   Reveal Solution Discussion Select an answer first