Runtime Application Self-Protection (RASP) ECDE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which statement accurately describes the protection scope of RASP compared to a WAF?

   • ARASP protects the application from within, while WAF protects it from outside by filtering incoming traffic
   • BRASP protects only the network layer, while WAF protects the application layer
   • CRASP and WAF have identical protection scopes and deployment methods
   • DRASP protects only against SQL injection, while WAF protects against all types of attacks
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   RASP in blocking mode has blocked a request that the security team believes is a true positive. The request was from an internal IP address and contained a SQL injection payload. The team is concerned that the attacker may have already exploited a similar vulnerability before RASP was deployed. What is the most appropriate next step in the incident response process?

   • AImmediately block the internal IP address at the firewall to prevent further attacks.
   • BDisable RASP blocking to avoid alerting the attacker that they are being monitored.
   • CSearch the RASP and application logs for prior requests from the same IP address or with similar payloads to determine if the attack was attempted before.
   • DRestore the database from the last backup to ensure no data was compromised.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How can RASP logging aid in incident response?

   • ABy automatically rolling back the application to a previous version
   • BBy notifying law enforcement automatically
   • CBy providing a record of the attack details, including the payload and the application's response
   • DBy deleting all user data that may have been compromised
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is evaluating RASP deployment modes for a legacy .NET application that is no longer actively developed. The application is critical and cannot be recompiled or modified. The team is considering agent-based RASP versus an embedded RASP library. The application runs on a dedicated Windows server, and the team is concerned about performance overhead. Which deployment mode is more appropriate?

   • AAgent-based RASP that attaches to the .NET runtime at startup.
   • BContainer-based RASP that wraps the application in a new container image.
   • CNetwork-based RASP that inspects traffic at the server's network interface.
   • DEmbedded RASP library compiled into the application.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security architect is explaining RASP to a development team that is new to runtime security. The team asks why RASP is considered more effective than a WAF for detecting certain attacks. Which explanation is most accurate?

   • ARASP replaces the need for all other security controls, including WAFs and network firewalls.
   • BRASP has visibility into the application's internal logic and data flow, allowing it to detect attacks that WAFs cannot see.
   • CRASP is easier to deploy than a WAF because it does not require any configuration.
   • DRASP only detects attacks that are already known and have published signatures.
   Reveal Solution Discussion Select an answer first