Incorporate Runtime Protection (e.g., Runtime Application Self Protection (RASP), Web Application Firewall (WAF), Address Space Layout Randomization (ASLR), Dynamic Execution Prevention) CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A development team is hardening a Linux-based web server that hosts a PHP application. The team wants to prevent attackers from executing shellcode injected into writable memory regions such as the stack or heap. The application must remain fully functional. Which runtime protection mechanism should the team enable at the operating system level?

   • AConfigure a WAF to filter outbound responses from the web server.
   • BEnable ASLR to randomize the base address of the PHP interpreter.
   • CDeploy a RASP agent to validate all user input before it reaches the PHP interpreter.
   • DEnable NX (No-eXecute) / DEP on the server's CPU and kernel to mark stack and heap as non-executable.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which statement best describes how Runtime Application Self Protection (RASP) operates?

   • AIt monitors network traffic at the perimeter and blocks malicious requests before they reach the application.
   • BIt is embedded within the application runtime to observe internal behavior and block attacks in real time.
   • CIt is a separate security appliance that scans the application's source code for vulnerabilities during development.
   • DIt randomizes memory addresses on each execution to prevent exploitation of memory corruption vulnerabilities.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which technique is commonly used to prevent code execution from non-executable memory regions?

   • AWeb Application Firewall (WAF)
   • BData Execution Prevention (DEP)
   • CRuntime Application Self Protection (RASP)
   • DAddress Space Layout Randomization (ASLR)
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a key advantage of using Runtime Application Self Protection (RASP) over a traditional network-based firewall?

   • ARASP is a hardware appliance that provides a physical barrier between the application and the internet.
   • BRASP can block all network-level attacks, including DDoS, without any additional infrastructure.
   • CRASP requires no configuration or tuning once deployed, making it a set-and-forget solution.
   • DRASP can analyze application-specific logic and context to detect attacks that network firewalls might miss.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security engineer is evaluating the runtime protections of a Linux application that processes untrusted input. The application is compiled with ASLR and DEP/NX enabled. A penetration test shows that a heap overflow can still be exploited to achieve code execution. Which additional control would most effectively mitigate this specific attack?

   • ADisable ASLR to simplify debugging and identify the overflow location.
   • BDeploy a WAF in front of the application to filter input.
   • CEnable stack canaries and heap integrity checks in the application's compiler flags.
   • DUse a RASP agent to monitor file system writes.
   Reveal Solution Discussion Select an answer first