Runtime Application Self-Protection (RASP) ECDE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which factor can influence the performance impact of RASP on an application?

   • AThe number of security rules enabled
   • BThe geographic location of the development team
   • CThe color scheme of the application's user interface
   • DThe name of the application's database
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which action is appropriate after RASP blocks an attack in production?

   • ADisabling RASP to prevent further false positives
   • BChanging all user passwords immediately
   • CDocumenting the incident and reviewing RASP policies to improve future detection
   • DRestoring the application from backup without investigating the attack
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   RASP in blocking mode has just blocked a request that appears to be a SQL injection attempt against a production API. The security team needs to respond. What is the first step in the incident response process?

   • AImmediately shut down the affected application instance to prevent further attacks.
   • BVerify the RASP alert and correlate it with application logs to confirm whether the blocked request was actually malicious.
   • CDisable RASP blocking to avoid impacting legitimate users while investigating.
   • DRestore the database from the last backup to remove any potential damage.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A team is running a latency-sensitive application and has deployed RASP in blocking mode. They notice that the 99th percentile latency has increased significantly. The team has already tuned the RASP policy to reduce the number of checks. What is the next most effective step to reduce the performance impact?

   • AIncrease the number of application instances to distribute the load.
   • BProfile the application to identify which RASP checks are the most expensive and selectively disable or optimize those specific checks.
   • CDisable RASP entirely for the most common request paths.
   • DSwitch RASP to monitoring mode to eliminate the blocking overhead.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company's RASP system detects a zero-day exploit attempt against a critical application. The attack is blocked, but the security team needs to determine if the vulnerability exists and if any data was compromised. What is the first step in the incident response process?

   • AImmediately patch the application with the latest security updates.
   • BNotify all customers of a potential data breach.
   • CReview the RASP logs to understand the attack vector and identify the vulnerable code path.
   • DDisable the application to prevent further attacks.
   Reveal Solution Discussion Select an answer first