Runtime Application Self-Protection (RASP) ECDE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a potential implication of using an embedded RASP deployment mode?

   • AIt is easier to deploy than agent-based RASP because it requires no changes to the application
   • BIt requires the application to be recompiled with security features
   • CIt provides deep integration with the application but may require more development effort to implement
   • DIt can only be used with containerized applications
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which type of attack can RASP detect and block at runtime?

   • APhishing attacks targeting end users
   • BPhysical tampering with server hardware
   • CDistributed denial-of-service (DDoS) attacks at the network layer
   • DSQL injection
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company runs a high-traffic API service with strict latency requirements (p99 < 200ms). After deploying agent-based RASP, the p99 latency increased to 450ms. The team identified that the RASP agent is performing deep inspection on every request. The application has several endpoints, but only two endpoints handle sensitive data and require full RASP protection. The team wants to restore performance while maintaining protection for the sensitive endpoints. What is the best approach?

   • AIncrease the number of application instances to distribute the RASP overhead across more servers.
   • BConfigure RASP policy rules to apply full inspection only to the sensitive endpoints and use a lighter inspection profile for the remaining endpoints.
   • CRemove RASP from the API service and rely on the existing WAF for all protection.
   • DSwitch RASP to monitor-only mode for all endpoints to reduce the processing overhead.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a common strategy to mitigate the performance overhead of RASP?

   • ARunning RASP in monitoring mode instead of blocking mode
   • BDisabling RASP during peak traffic hours
   • CDeploying RASP on a separate server that proxies all requests
   • DUsing RASP only for read-only endpoints
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a characteristic of agent-based RASP deployment?

   • AIt runs as a separate process that monitors the application from outside
   • BIt is installed as a library or agent within the application runtime to monitor and block attacks
   • CIt requires modifying the application source code to include security logic
   • DIt is deployed as a network appliance in front of the application
   Reveal Solution Discussion Select an answer first