3.1 Analyze Components in a Threat Model 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of a data asset in a threat model?

   • AA network firewall that filters traffic
   • BA web server running the company's public website
   • CAn application programming interface (API) that exposes business functions
   • DA customer database containing personally identifiable information (PII)
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A multinational corporation is threat modeling its global HR system, which stores employee data for all regions. The system is hosted in a single data center in the United States. The company is expanding into the European Union and must comply with GDPR. The threat model must account for data residency requirements. Which asset classification and risk consideration is most appropriate?

   • AMove all data to the EU to avoid any issues
   • BIgnore data residency because the data is in the US
   • CClassify all employee data equally, regardless of region
   • DClassify EU employee data as high criticality and consider data residency as a key risk factor
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company's threat model for a web application identifies a cross-site scripting (XSS) vulnerability in a search feature. The application is public-facing and used by customers. The team is considering two mitigations: (1) implementing output encoding, and (2) adding a web application firewall (WAF) rule to block XSS payloads. The company has a strict budget and wants the most reliable mitigation. Which should they choose?

   • ADisable the search feature
   • BAdd a WAF rule to block XSS payloads
   • CDo both, but only if budget allows
   • DImplement output encoding
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has a legacy system that processes credit card transactions. The threat model identifies a critical vulnerability in the system that could allow an attacker to steal card data. The company has limited budget and must choose between two mitigations: (1) implementing network segmentation to isolate the system, or (2) upgrading the system to a modern, patched platform. The upgrade is expensive and may cause downtime. The company's compliance requirements mandate that card data must be protected. Which approach should the company take?

   • AUpgrade the system immediately, regardless of cost
   • BOnly implement network segmentation and skip the upgrade
   • CDo nothing and accept the risk
   • DImplement network segmentation first, then plan the upgrade
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A financial services company is conducting a threat model for its new mobile banking application. The team must identify which assets are most critical to protect. The application stores user credentials, transaction history, and the app's source code in a repository. Which asset should be classified as having the highest criticality for confidentiality?

   • AMarketing brochure PDFs
   • BTransaction history
   • CUser credentials
   • DSource code repository
   Reveal Solution Discussion Select an answer first