Runtime Application Self-Protection (RASP) ECDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During a security incident, RASP blocks a request that is later determined to be a false positive. The blocked request was from a legitimate user performing a valid action. What should the team do to prevent this from happening again?

   • AIgnore the false positive because it is a one-time event.
   • BReview the RASP rule that triggered the block and add an allowlist entry for the legitimate pattern, then test the change in staging.
   • CDisable the RASP rule that triggered the block in production immediately.
   • DSwitch RASP to monitoring mode for all rules to avoid blocking legitimate users.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   After deploying RASP in monitoring mode, a team notices that the number of blocked events is very low, but the logs show many 'suspicious' events that were not blocked. The security team wants to reduce false negatives without causing application downtime. What should the team do first?

   • ASwitch RASP to blocking mode for all suspicious events immediately.
   • BReview the RASP logs to identify which suspicious events are true attacks and then create targeted blocking rules for those patterns.
   • CIncrease the sensitivity of the RASP policy to the maximum level.
   • DDisable the suspicious event logging to reduce noise.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has deployed RASP to a production application and is experiencing a 20% increase in CPU usage. The team has identified that the RASP agent is performing deep inspection on all requests, including static resources like images and CSS files. The team wants to reduce CPU overhead without reducing protection for dynamic requests. What is the most effective approach?

   • ADisable RASP for all GET requests and only inspect POST requests.
   • BMove RASP to a separate server and proxy all requests through it.
   • CIncrease the RASP agent's thread count to process more requests in parallel.
   • DConfigure RASP to skip inspection for static resource paths and apply full inspection only to dynamic endpoints.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a runtime attack that RASP is specifically designed to detect?

   • AARP spoofing on the local network
   • BCross-site scripting (XSS)
   • CMan-in-the-middle attacks on TLS connections
   • DDNS cache poisoning
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A team is deploying a legacy .NET Framework application on Windows servers. The application cannot be recompiled, and the team wants to add RASP protection without changing the application code. Which RASP deployment mode is most appropriate?

   • AContainer sidecar mode, which runs RASP as a separate process alongside the application.
   • BAgent-based mode, which instruments the application at runtime without requiring source code changes.
   • CEmbedded mode, which requires the RASP library to be linked into the application at build time.
   • DNetwork-based mode, which inspects traffic at the load balancer.
   Reveal Solution Discussion Select an answer first