Runtime Application Self-Protection (RASP) ECDE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A high-traffic e-commerce application is experiencing increased latency after enabling RASP in blocking mode. The performance team reports that the overhead is most noticeable during peak hours. The security team wants to maintain protection while reducing the performance impact. Which approach is most effective?

   • ATune the RASP policy to disable or reduce the frequency of the most expensive checks for non-critical attack types.
   • BDisable RASP logging to reduce I/O overhead.
   • CIncrease the number of application instances to distribute the load.
   • DSwitch RASP to monitoring mode during peak hours and back to blocking mode off-peak.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company's RASP deployment is generating a large number of security events that the security operations center (SOC) needs to triage. The SOC team is overwhelmed and missing critical alerts. The team wants to improve the efficiency of monitoring without losing visibility into real attacks. What should the team implement?

   • AConfigure RASP to send only high-severity alerts to the SIEM and create a separate dashboard for lower-severity events.
   • BRoute all RASP alerts directly to the development team for analysis.
   • CDisable logging for all RASP events except those that result in a blocked request.
   • DIncrease the RASP alert threshold so that only attacks targeting critical vulnerabilities generate alerts.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company has deployed agent-based RASP to a production e-commerce application. After one week, the security team observes a 15% increase in latency and a high volume of alerts for what appear to be legitimate user actions. The team wants to reduce the performance impact while keeping protection for critical attack vectors. What should the team do first?

   • ADisable RASP protection for all endpoints except the login and payment pages.
   • BIncrease the RASP sampling rate to capture more data for analysis.
   • CReview the RASP alert logs to identify false-positive patterns and adjust policy rules to whitelist those specific legitimate operations.
   • DMove the RASP agent to monitor-only mode and disable blocking entirely.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company wants to enforce RASP protection on every build that reaches production. The pipeline uses ephemeral build agents and produces immutable container images. The team wants to verify that RASP is correctly installed and configured before an image is promoted. What is the most effective way to integrate RASP into the CI/CD pipeline?

   • AInstall RASP on the production hosts and rely on the orchestrator to attach it to each pod at runtime.
   • BAdd a pipeline stage that runs the container with RASP in monitoring mode and executes a set of attack simulations, failing the build if the expected events are not logged.
   • CRun a static scanner on the Dockerfile to confirm the RASP agent is listed as a dependency.
   • DEnable RASP in blocking mode in the staging environment and manually test the application's main workflows.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is a primary benefit of RASP monitoring and logging capabilities?

   • AThey replace the need for application performance monitoring (APM)
   • BThey encrypt all application logs to protect data at rest
   • CThey provide visibility into runtime attacks and application behavior
   • DThey automatically patch vulnerabilities in the application
   Reveal Solution Discussion Select an answer first