Runtime Application Self-Protection (RASP) ECDE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A development team is deploying a new web application and wants to use RASP to protect against common attacks. The team is particularly concerned about SQL injection and cross-site scripting (XSS). The team wants to ensure RASP is configured to detect these attacks. What should the team do?

   • AEnable the RASP rules for SQL injection and XSS in the policy configuration.
   • BUse a WAF instead of RASP because WAFs are better at detecting SQL injection and XSS.
   • CRun RASP in monitor-only mode and never enable blocking.
   • DDeploy RASP and assume it will automatically detect all attacks without configuration.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A DevSecOps team wants to use RASP logs to improve their security posture. They want to identify which attack vectors are most commonly attempted against their application. Which approach best uses RASP monitoring capabilities?

   • AExport RASP logs to a spreadsheet and manually review each event.
   • BAggregate RASP events by attack type and source IP, and review the top patterns in a SIEM dashboard.
   • CEnable RASP blocking mode for all attack types and review the blocked requests in the application logs.
   • DDisable RASP logging for low-severity events to reduce noise.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security architect is explaining to a developer why RASP is being added to a new microservice. The developer asks: 'We already have a WAF in front of the API. Why do we need RASP?' Which response best explains the difference?

   • ARASP runs inside the application and can detect attacks that the WAF cannot see, such as logic flaws or attacks that occur after the request is parsed.
   • BRASP is easier to deploy because it does not require any configuration.
   • CRASP only detects attacks, while the WAF blocks them.
   • DRASP replaces the WAF, so you no longer need to maintain the WAF rules.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   How can RASP be integrated into a CI/CD pipeline to provide continuous security?

   • ABy embedding RASP agents into the application build and configuring them to activate during runtime
   • BBy using RASP to replace all other security testing tools in the pipeline
   • CBy manually installing RASP on production servers after each release
   • DBy running RASP as a one-time scan after deployment and then removing it
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which action is appropriate when tuning RASP to reduce false positives?

   • ABlocking all requests that contain special characters
   • BIgnoring all alerts that occur during business hours
   • CIncreasing the sensitivity of all detection rules to catch more attacks
   • DCreating exceptions for known benign patterns that trigger alerts
   Reveal Solution Discussion Select an answer first