Runtime Application Self-Protection (RASP) ECDE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A team has deployed RASP in monitoring mode and is seeing a high number of false positives. The false positives are causing alert fatigue and the team is starting to ignore RASP alerts. What is the best way to reduce false positives while maintaining visibility into real attacks?

   • ASwitch RASP to blocking mode so that false positives are automatically blocked and do not generate alerts.
   • BIncrease the sensitivity of all RASP rules to catch more attacks.
   • CDisable all RASP alerts and only review the logs weekly.
   • DAnalyze the false positive patterns and create allowlists or adjust the sensitivity of specific rules that are causing the false positives.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company is deploying a new web application and must decide between using a WAF, RASP, or both. The application is a public-facing API that handles sensitive data. The security team is concerned about both network-level attacks and application-level attacks that exploit business logic. Which approach provides the most comprehensive protection?

   • ADeploy neither and rely on the application framework's built-in security features.
   • BDeploy only RASP because it can block all types of attacks.
   • CDeploy only a WAF because it can block all types of attacks.
   • DDeploy both a WAF and RASP, with the WAF filtering network-level attacks and RASP protecting against application-level attacks.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary purpose of Runtime Application Self-Protection (RASP) in the release and deploy stage?

   • ATo scan source code for vulnerabilities before deployment
   • BTo replace the need for security testing during the development phase
   • CTo filter network traffic at the perimeter before it reaches the application
   • DTo provide real-time protection by monitoring and blocking attacks from within the application runtime
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which statement best describes the role of RASP in the release and deploy stage?

   • AIt performs static analysis of the codebase to identify vulnerabilities prior to deployment
   • BIt manages user authentication and authorization for the application
   • CIt provides runtime protection by instrumenting the application to detect and block attacks in real time
   • DIt encrypts all data in transit between the application and its users
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A financial services company runs a critical payment processing application with RASP in blocking mode. At 2:00 AM, the RASP console shows repeated blocked attempts to exploit a command injection vulnerability in a legacy file-upload module. The alerts show the same source IP and a pattern of increasing sophistication. The on-call engineer needs to respond. Which action should the engineer take first?

   • AChange the RASP policy to monitor-only mode to reduce the chance of blocking legitimate uploads.
   • BDisable the file-upload module in the application configuration to eliminate the vulnerable code path.
   • CVerify the blocking is working correctly and review the RASP logs to confirm the attack is being prevented, then escalate to the security incident response team.
   • DImmediately shut down the payment application to prevent any potential data breach.
   Reveal Solution Discussion Select an answer first