3.1 Analyze Components in a Threat Model 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is it important to document a threat model?

   • ATo automate the deployment of security controls
   • BTo satisfy legal requirements for data protection
   • CTo provide a clear record of identified threats, risks, and mitigations that can be communicated to stakeholders
   • DTo replace the need for regular security testing
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's threat model has identified two risks: Risk A has a high likelihood and high impact; Risk B has a low likelihood and high impact. The company has limited resources and must prioritize. According to standard risk assessment principles, which risk should be addressed first?

   • ABoth equally, because both have high impact
   • BRisk B, because high impact always takes precedence
   • CRisk A, because it has a higher overall risk score
   • DNeither, because risk assessment is only qualitative
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In threat modeling, what is a trust boundary?

   • AA cryptographic key used to encrypt data in transit
   • BA physical barrier that prevents unauthorized access to a data center
   • CA point where data flows from one trust level to another, such as from an untrusted network to a trusted network
   • DA firewall rule that allows or denies specific traffic
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial services company is adopting a new microservices-based payment platform. The security team needs to choose a threat modeling methodology that will help them systematically identify threats by examining each component's interactions and data flows, and also provide a structured way to prioritize the risks they find. Which methodology best fits this requirement?

   • APASTA
   • BDREAD
   • CSTRIDE
   • DAttack trees
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A retail company is threat modeling its e-commerce application. The team has identified the following assets: customer PII in the database, the web server, the payment gateway integration, and the marketing email list. The company's primary concern is regulatory fines from a data breach. Which asset should be classified as the highest criticality for the threat model?

   • ACustomer PII in the database
   • BThe marketing email list
   • CThe web server
   • DThe payment gateway integration
   Reveal Solution Discussion Select an answer first