Runtime Application Self-Protection (RASP) ECDE Practice Questions (Page 11)

Questions 51–51

1. 51expert · hard

   A company is adopting DevSecOps and wants to integrate RASP into their CI/CD pipeline. The pipeline currently builds a Docker image, runs unit tests, and deploys to a staging environment. The team wants to ensure that RASP is tested and validated before production deployment. They have two options: (1) run RASP as a step in the pipeline that fails the build on critical findings, or (2) deploy RASP to staging in monitor-only mode and review results before production. Which approach is more aligned with DevSecOps principles?

   • ADeploy RASP to staging in monitor-only mode, run integration tests, and review the findings before promoting to production with RASP in blocking mode.
   • BDeploy RASP directly to production in blocking mode and monitor for issues.
   • CUse RASP only in the staging environment and never enable it in production.
   • DRun RASP as a build step that fails the pipeline on any critical finding.
   Reveal Solution Discussion Select an answer first