Runtime Application Self-Protection (RASP) ECDE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A SOC analyst is investigating a potential breach. The RASP logs show that an attacker attempted to exploit a path traversal vulnerability, but the attack was blocked. The analyst needs to provide a detailed report to management. Which information from the RASP logs is most important to include in the report?

   • AOnly the number of blocked attacks in the last 24 hours.
   • BThe list of all IP addresses that accessed the application in the last hour.
   • CThe version of the RASP agent and the application build number.
   • DThe timestamp, source IP, the exact request that triggered the alert, and the RASP rule that blocked it.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A DevSecOps team is deploying a containerized Java microservice behind an existing WAF. The security lead wants to detect and block SQL injection attempts that reach the application logic after the WAF has already passed the request. The team cannot modify the application source code. Which approach best meets this requirement?

   • AEnable database-level audit logging to detect suspicious queries after the fact.
   • BPlace a network-based IDS in front of the application to monitor traffic.
   • CDeploy a RASP agent inside the application container that instruments the Java runtime.
   • DAdd additional WAF rules to inspect the request body for SQL keywords.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A DevSecOps team is integrating RASP into their CI/CD pipeline. The team has a multi-stage pipeline: build, test, staging, and production. They want to ensure that RASP is deployed consistently across all environments and that policies are managed centrally. The team is considering using infrastructure as code (IaC) to manage RASP deployment. What is the most effective approach?

   • ADeploy RASP only in production and rely on other security tools in lower environments.
   • BManually install RASP in each environment and configure policies through the RASP console.
   • CDefine RASP agent installation and policy configuration as code in the IaC templates for each environment.
   • DUse a separate RASP policy for each environment without any version control.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is a common practice for integrating RASP into a CI/CD pipeline?

   • AConfiguring RASP to block all traffic during the build stage to test security
   • BRunning RASP only in the development environment and not in production
   • CAdding a RASP agent as a step in the deployment automation so it is installed with the application
   • DUsing RASP to perform static analysis of the code during the build stage
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A team is deploying a new Java application to a Kubernetes cluster. They want to use RASP but are concerned about the overhead of running an agent in each pod. They are considering an embedded RASP library that is compiled into the application. What is a key trade-off of this approach?

   • AThe embedded library does not require any performance tuning because it is compiled into the application.
   • BThe embedded library cannot be configured, so it is easier to manage.
   • CThe embedded library runs in a separate process, reducing the application's memory footprint.
   • DThe embedded library is tightly coupled to the application version, so updating RASP requires rebuilding and redeploying the application.
   Reveal Solution Discussion Select an answer first