Incorporate Runtime Protection (e.g., Runtime Application Self Protection (RASP), Web Application Firewall (WAF), Address Space Layout Randomization (ASLR), Dynamic Execution Prevention) CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A software vendor ships a Windows desktop application that processes sensitive local files. Penetration testing revealed a buffer overflow in a legacy C++ module that cannot be patched immediately. The security team wants to reduce the likelihood of successful exploitation while the patch is developed. Which runtime protection mechanism should the team verify is enabled on target systems?

   • AASLR with high-entropy 64-bit randomization for the application's executable and dependent DLLs.
   • BA RASP agent that monitors the application's file access patterns.
   • CA web application firewall (WAF) inspecting outbound HTTP traffic from the application.
   • DDisabling the application's exception handling to prevent crash recovery.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is an essential activity for maintaining the effectiveness of runtime protection controls?

   • ARegularly monitoring logs and alerts from the protection mechanisms.
   • BKeeping the controls unchanged to ensure stability.
   • CDisabling the controls during maintenance windows.
   • DOnly updating the controls when a breach occurs.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security engineer is reviewing the exploitability of a memory-corruption vulnerability in a Linux application. The application is compiled with ASLR enabled, but the engineer notes that the vulnerability can still be exploited reliably. Which additional runtime protection should the engineer recommend to make exploitation significantly harder?

   • AEnable DEP/NX to mark the stack and heap as non-executable.
   • BDeploy a WAF in front of the application.
   • CUse a RASP agent to monitor file system access.
   • DDisable ASLR to simplify the memory layout for debugging.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a key consideration when integrating runtime protection into the deployment phase?

   • AOnly enabling protection during peak usage times.
   • BDeploying protection mechanisms only in the production environment, not in staging.
   • CEnsuring the protection mechanisms are configured and enabled before the application goes live.
   • DRemoving all runtime protection after the application is stable to reduce overhead.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A healthcare organization is deploying a new patient-portal web application. The compliance team requires runtime protection against OWASP Top 10 attacks, but the application is developed by a third party and the source code is not available for modification. The deployment must include a control that can be tuned without vendor involvement. What should the organization incorporate into the deployment pipeline?

   • AA RASP agent embedded in the application's runtime.
   • BA network-based IPS that inspects all traffic to the database server.
   • CA WAF positioned in front of the application with a rule set aligned to the OWASP Top 10.
   • DA host-based intrusion detection system (HIDS) that monitors file integrity on the web server.
   Reveal Solution Discussion Select an answer first