312-97: EC-Council Certified DevSecOps Engineer (ECDE)Demo

By ECCouncil · Question Mode

QuestionQ77

DevSecOps Pipeline-Operate and Monitor Stage

Sarah Wheeler is an experienced DevSecOps engineer who has recently joined an IT company that develops software products for customers located across the globe. She wants to use a security testing tool that protects the application from false positives, network sniffing, tampering with code, and similar threats. The tool should:

  • Monitor incoming traffic to the server and APIs for suspicious activity
  • Help her team detect and remediate these issues during runtime

Which of the following tools should Sarah select so that her team can precisely detect and remediate security issues in the application code during runtime?

  • A IAST
  • B DAST
  • C SAST
  • D RASP
Explanation

RASP (Runtime Application Self-Protection) is designed to be integrated into or wrapped around an application's runtime environment so it can continuously monitor inbound traffic, API calls, and application behavior in real time. Because it operates with full context of the application's runtime state, it can accurately distinguish genuine attacks (such as tampering, injection, or network sniffing attempts) from benign activity, reducing false positives, and it can automatically block or remediate malicious requests as they occur in production. This differentiates it from SAST (static code analysis before runtime), DAST (external black-box testing of a running app without code-level remediation), and IAST (instrumented testing during QA/test cycles, not production runtime protection).

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!