Runtime Application Self-Protection (RASP) ECDE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is comparing RASP and WAF capabilities for a new application deployment. The application has a critical vulnerability in a custom XML parser that processes user-supplied files. The team needs protection that can detect and block the attack at the exact moment the vulnerable code executes. Which statement correctly describes the advantage of RASP over WAF in this scenario?

   • ARASP requires the application to be recompiled to add protection for the XML parser vulnerability.
   • BWAF provides better protection for this vulnerability because it can block the file upload before it reaches the application.
   • CWAF can decode and inspect the XML payload more reliably than RASP because it sees the raw HTTP request.
   • DRASP can inspect the actual data flow inside the application and block the attack when the XML parser processes the malicious input.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the first step in an incident response process when RASP detects a threat in production?

   • ADeleting all logs related to the alert
   • BImmediately shutting down the entire application
   • CAcknowledging the alert and assessing its severity and impact
   • DIgnoring the alert if it occurs during off-peak hours
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A team is deploying RASP to a large portfolio of applications. They want to minimize the operational overhead of managing RASP policies while ensuring each application is protected. The team has a mix of legacy and modern applications. Which approach best balances policy management and protection?

   • ADisable RASP for legacy applications because they are being replaced soon.
   • BUse the same RASP policy for all applications without customization.
   • CCreate a baseline RASP policy with the most critical protections enabled, then customize it for applications that have specific requirements or have shown a higher risk profile.
   • DCreate a unique RASP policy for each application from scratch.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a key strategy for tuning RASP policies to minimize false positives while maintaining security?

   • AUsing the same RASP policy for all applications without customization
   • BDisabling RASP protections for all endpoints to avoid false positives
   • CRunning RASP in monitoring mode initially, analyzing alerts, and then adjusting policies before enabling blocking
   • DSetting all RASP protections to blocking mode immediately after deployment
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A team has deployed RASP in blocking mode for a web application. During a routine penetration test, the testers successfully exploited a stored XSS vulnerability, and RASP did not block the attack. The team needs to understand why RASP missed the attack and how to fix it. What is the most likely cause and the appropriate action?

   • AThe RASP agent was in monitor-only mode, so it logged the attack but did not block it.
   • BThe RASP policy did not include a rule for stored XSS, so the team should review and update the RASP policy to cover this attack type.
   • CRASP cannot detect XSS attacks because they occur in the browser, not in the application runtime.
   • DThe WAF should have blocked the attack, so the team should focus on WAF configuration instead of RASP.
   Reveal Solution Discussion Select an answer first