Incorporate Runtime Protection (e.g., Runtime Application Self Protection (RASP), Web Application Firewall (WAF), Address Space Layout Randomization (ASLR), Dynamic Execution Prevention) CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of Address Space Layout Randomization (ASLR)?

   • ATo encrypt the application's memory contents to prevent data theft.
   • BTo prevent the execution of code from non-executable memory regions.
   • CTo randomize the memory addresses of key data structures and code to make exploitation harder.
   • DTo monitor application behavior and block attacks in real time.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is deploying a new web application and must choose a WAF deployment model. The application has unpredictable traffic spikes and the company wants to minimize latency for users. The security team has limited expertise in managing WAF infrastructure. Which WAF deployment model best meets these requirements?

   • AA self-managed WAF on a cluster of VMs with a load balancer.
   • BA cloud-managed WAF service that scales automatically and requires no infrastructure management.
   • CA self-managed WAF on a single VM that the team patches and scales manually.
   • DA RASP agent deployed on the application server instead of a WAF.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is deploying a new web application and must choose between a WAF and RASP. The application handles sensitive data and is subject to a regulation that requires runtime protection against injection attacks. The company has a small security team with limited time for tuning. The application is developed in-house and the team has full access to the source code. Which approach best balances protection and operational effort?

   • ADeploy only a WAF with a managed rule set and no additional runtime controls.
   • BDeploy a WAF with a managed rule set and enable RASP in detection mode initially to gather data before enabling blocking.
   • CDeploy only RASP in blocking mode immediately without prior testing.
   • DDeploy neither and rely on secure coding practices during development.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A retail company runs a public-facing web storefront on Azure App Service. The security team wants to protect the application from common web attacks such as cross-site scripting (XSS) and SQL injection without modifying application code. The solution must be managed by the cloud provider and require minimal operational overhead. What should the security team configure?

   • AEnable Azure Defender for Cloud's just-in-time (JIT) VM access on the App Service plan.
   • BConfigure network security groups (NSGs) on the App Service subnet to block inbound port 443 traffic.
   • CEnable Azure Application Gateway with the Web Application Firewall (WAF) policy and associate it with the App Service.
   • DDeploy a third-party RASP agent into the App Service runtime.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial services firm deploys a custom Java web application that handles sensitive transactions. The security team wants to detect and block SQL injection and command injection attempts that bypass the WAF because they originate from authenticated users exploiting business-logic flaws. The application must continue running without requiring a network architecture change. What should the security team implement?

   • AAdd a second WAF instance in front of the existing WAF to provide defense-in-depth for authenticated traffic.
   • BEnable verbose error logging on the application server and review logs weekly for suspicious patterns.
   • CDeploy a network-based intrusion prevention system (IPS) inline before the application servers.
   • DIntegrate a RASP agent into the application runtime to monitor internal calls and block malicious input at the point of execution.
   Reveal Solution Discussion Select an answer first