Incorporate Runtime Protection (e.g., Runtime Application Self Protection (RASP), Web Application Firewall (WAF), Address Space Layout Randomization (ASLR), Dynamic Execution Prevention) CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company's WAF has been in production for six months. The security team notices that the WAF is blocking legitimate user traffic after a recent application update introduced a new URL parameter format. The team needs to restore service quickly while maintaining protection. What should the team do first?

   • AAdd a second WAF in parallel to load-balance traffic and reduce the impact of false positives.
   • BImmediately disable the entire WAF to restore all traffic and re-enable it after the next application release.
   • CRevert the application update to the previous version without further investigation.
   • DReview the WAF logs to identify the specific rule that is triggering false positives and temporarily disable that rule while validating the new parameter format.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An e-commerce platform uses a RASP agent in its Java application. After a routine update to the RASP rules, the security team observes that the agent is blocking a high volume of requests from a new, legitimate marketing campaign that uses URL shorteners. The team needs to maintain protection while allowing the campaign traffic. What should the team do?

   • ADisable RASP entirely for the marketing campaign period and re-enable it afterward.
   • BIncrease the RASP sensitivity threshold to reduce the number of blocked requests.
   • CChange the application code to bypass RASP for all requests containing a URL parameter.
   • DCreate an allowlist in the RASP configuration for the specific URL-shortener domains and monitor the traffic for anomalies.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   During which phase of the SDLC should runtime protection mechanisms be incorporated?

   • AThroughout the SDLC, especially during deployment and operations.
   • BOnly during the deployment phase.
   • COnly during the initial design phase.
   • DOnly during the maintenance phase.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How does ASLR mitigate the exploitation of memory corruption vulnerabilities?

   • ABy scanning all incoming data for malicious patterns before it is processed.
   • BBy isolating each process in its own virtual machine.
   • CBy preventing the application from writing to read-only memory.
   • DBy making the addresses of critical memory regions unpredictable to the attacker.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A large online payment platform uses both a WAF and RASP. The WAF blocks common web attacks, while RASP monitors internal behavior. After a new feature release, the security team observes that RASP is generating a high number of false positives, blocking legitimate transactions. The WAF is not blocking these transactions. The team must restore service immediately but cannot disable RASP entirely due to compliance requirements. What should the team do?

   • ARevert the new feature release to the previous version without further investigation.
   • BDisable RASP for the entire application and rely on the WAF for protection.
   • CAnalyze the RASP logs to identify the specific rule causing false positives and create a temporary exception for the affected transaction pattern while keeping all other RASP rules active.
   • DIncrease the WAF's sensitivity to block more traffic, hoping it will catch the transactions RASP is blocking.
   Reveal Solution Discussion Select an answer first