Incorporate Runtime Protection (e.g., Runtime Application Self Protection (RASP), Web Application Firewall (WAF), Address Space Layout Randomization (ASLR), Dynamic Execution Prevention) CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which type of attack is a Web Application Firewall (WAF) specifically designed to detect and block?

   • AMan-in-the-middle attacks on encrypted traffic
   • BPhysical theft of the server hardware
   • CDenial of Service (DoS) at the network layer
   • DSQL injection
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has deployed RASP in its production application. The security team wants to ensure the RASP rules remain effective as the application evolves. Which ongoing activity is most important for maintaining RASP effectiveness?

   • AReplace RASP with a WAF because WAFs require no ongoing maintenance.
   • BSet RASP to block all traffic and never review logs to minimize operational overhead.
   • CRegularly review RASP logs and alerts to identify new attack patterns and tune rules accordingly.
   • DDisable RASP after the first month of operation because the initial tuning is sufficient.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is ongoing tuning of runtime protection controls necessary?

   • ATo ensure the protection mechanisms are disabled when not needed.
   • BTo reduce false positives and adapt to new attack patterns.
   • CTo comply with licensing requirements.
   • DTo increase the complexity of the protection system.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has both a WAF and RASP deployed for its web application. The security team is planning the quarterly maintenance cycle. The team has limited staff and must prioritize tasks. Which maintenance task should be performed FIRST to ensure the controls remain effective?

   • ADisable RASP for a week to test the WAF's effectiveness independently.
   • BUpdate the WAF rules to the latest vendor version without reviewing the changelog.
   • CGenerate a report of all blocked traffic and archive it without analysis.
   • DReview the latest threat intelligence and vendor advisories to identify new attack techniques and required rule updates for both WAF and RASP.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is investigating a malware infection on a Windows server. The malware was able to execute code from a memory region that should have been non-executable. The analyst wants to determine why DEP did not prevent the execution. Which configuration issue could explain this?

   • AThe RASP agent was not installed on the server.
   • BASLR was disabled for the entire system.
   • CThe WAF was not configured to filter the malware's command-and-control traffic.
   • DDEP was set to 'OptOut' mode and the application was added to the exclusion list.
   Reveal Solution Discussion Select an answer first