3.1 Analyze Components in a Threat Model 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a common motivation for a hacktivist threat actor?

   • APersonal challenge or curiosity to test their skills
   • BFinancial gain through ransomware or theft of financial data
   • CPolitical or social activism, often targeting organizations to promote a cause
   • DState-sponsored espionage to steal national secrets
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which threat modeling methodology is best suited for prioritizing risks by assigning numerical ratings to factors such as damage potential, reproducibility, and exploitability?

   • APASTA
   • BSTRIDE
   • CDREAD
   • DAttack trees
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A hospital is deploying a new patient portal that allows patients to upload medical images through a web application. The web server sits in a DMZ, and the database containing PHI is on the internal network. During threat modeling, the team maps the data flow from the patient's browser to the database. Which component should be explicitly identified as a trust boundary in this data flow?

   • AThe web application's input validation module
   • BThe network firewall between the DMZ and the internal network
   • CThe database's backup tape storage location
   • DThe TLS termination point on the web server
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security architect is leading a threat modeling exercise for a new cloud-based application that will handle sensitive customer data. The team has limited time and must decide which threats to address first. They have already mapped the data flows and identified trust boundaries. Which next step should the team take to ensure the most effective use of their time?

   • AIdentify all possible threats using STRIDE and then score them with DREAD
   • BImmediately implement mitigations for the first threat identified
   • CFocus only on the trust boundaries and ignore other components
   • DUse PASTA to conduct a full risk analysis
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Who are the typical stakeholders that should be informed of the findings in a threat model?

   • AOnly the security team
   • BOnly the system administrators
   • COnly external auditors
   • DDevelopers, security analysts, and business decision-makers
   Reveal Solution Discussion Select an answer first