3.1 Analyze Components in a Threat Model 350-201 Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   During a threat model review of a web application, the team finds that the application uses an outdated library with a known remote code execution vulnerability. The library is used in a component that processes user-uploaded files. What should be the immediate recommendation?

   • AAdd a WAF rule to block file uploads
   • BDisable the file upload feature
   • CMonitor logs for exploitation attempts
   • DUpdate the library to a patched version
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security team is using DREAD to score threats for a new online banking feature. They have identified a threat that allows an attacker to transfer funds from any account. The team rates the damage as 10, reproducibility as 10, exploitability as 5, affected users as 10, and discoverability as 5. What is the DREAD risk score?

   • A8.0
   • B50
   • C40
   • D10
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the purpose of developing mitigation strategies in threat modeling?

   • ATo eliminate all possible threats to the system
   • BTo identify new vulnerabilities in the system
   • CTo document the threat model for compliance purposes
   • DTo reduce the risk of identified threats to an acceptable level
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   In the context of threat modeling, what is the primary purpose of asset identification and classification?

   • ATo create a complete inventory of all hardware and software for licensing purposes
   • BTo assign ownership of assets to specific employees for accountability
   • CTo determine the value and criticality of assets so that security controls can be prioritized
   • DTo ensure that all assets are encrypted and backed up
   Reveal Solution Discussion Select an answer first