3.1 Analyze Components in a Threat Model 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A government agency is threat modeling a new system that handles classified information. The team is concerned about a highly sophisticated adversary with significant resources and a long-term objective of stealing sensitive data. Which threat actor profile should be prioritized in this threat model?

   • AInsider threat
   • BScript kiddie
   • CHacktivist
   • DNation-state actor
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A startup is developing a new mobile banking app and wants to integrate threat modeling into their agile development process. The team is small and has limited security expertise. They need a lightweight approach that helps them identify and prioritize threats quickly without extensive overhead. Which approach best fits their needs?

   • AUse a simplified STRIDE-based checklist during design reviews
   • BOutsource all threat modeling to an external consultant
   • CWait until the app is fully developed before threat modeling
   • DConduct a full PASTA analysis for every feature
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is migrating its customer relationship management (CRM) system to a cloud provider. The threat model must identify which assets are most critical to the business. The CRM contains customer PII, sales forecasts, and marketing campaign data. Which asset should be classified as having the highest criticality for availability?

   • ACustomer PII
   • BSales forecasts
   • CMarketing campaign data
   • DThe CRM application itself
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A small business runs a public-facing web server that hosts a marketing site. The threat model identifies a critical vulnerability in the web server software, but the business has limited budget. The vulnerability is not yet publicly known and requires physical access to exploit. How should the team prioritize this risk?

   • AHigh priority because the vulnerability is critical
   • BLow priority because the exploit requires physical access and the vulnerability is not publicly known
   • CMedium priority because the server is public-facing
   • DDefer all action until the vulnerability is publicly disclosed
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is an example of a vulnerability in a web application?

   • AA data breach that exposes customer information
   • BA threat actor using phishing to steal credentials
   • CA firewall that blocks all incoming traffic
   • DA lack of input validation that allows SQL injection attacks
   Reveal Solution Discussion Select an answer first