A security team has completed a threat model for a Java application and needs to communicate the findings to a non-technical executive audience. The goal is to secure funding for mitigation efforts. Which approach is most effective for this communication?

Share the full data flow diagrams and trust boundaries so executives can see the technical architecture.

Email the complete threat model document and ask for questions.

Provide a summary of the top risks, their potential business impact, and the recommended mitigations with estimated costs.

Present a detailed list of all identified threats with their STRIDE categories and technical descriptions.

What is the main purpose of prioritizing threats in threat modeling?

To create a list of all possible threats for documentation purposes

To focus resources on the most critical threats that pose the highest risk

To assign a severity score to each threat for compliance reporting

To eliminate all threats from the system

A team is threat modeling a Java application that uses a third-party payment gateway. The application sends payment data to the gateway via an API. The team is identifying assets and entry points. Which of the following is the most critical asset to protect in this scenario?

The network connection to the payment gateway

A Java application has a feature that allows users to share files with other users via a link. The link contains a unique token that grants access to the file. A threat model identifies that an attacker who guesses or steals a token can access the file. The team is evaluating mitigations. Which mitigation is most effective in reducing the risk of token theft?

Use longer, cryptographically random tokens and expire them after a short period.

Require users to log in before accessing the link.

Encrypt the token using a secret key stored in the application's source code.

Log all file access attempts and alert on suspicious activity.

EC-CouncilCertified Application Security Engineer (Java)

Domain 2Objective 3

Threat Modeling CASEJAVA Practice Questions (Page 2)

Part of the Security Requirements and Secure Design domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 6–10

6foundation · easy
Which STRIDE threat category is primarily concerned with an attacker being able to modify data or code?
Select an answer first
7application · medium
A security team has completed a threat model for a Java application and needs to communicate the findings to a non-technical executive audience. The goal is to secure funding for mitigation efforts. Which approach is most effective for this communication?
Select an answer first
8foundation · easy
What is the main purpose of prioritizing threats in threat modeling?
Select an answer first
9expert · hard
A team is threat modeling a Java application that uses a third-party payment gateway. The application sends payment data to the gateway via an API. The team is identifying assets and entry points. Which of the following is the most critical asset to protect in this scenario?
Select an answer first
10expert · hard
A Java application has a feature that allows users to share files with other users via a link. The link contains a unique token that grants access to the file. A threat model identifies that an attacker who guesses or steals a token can access the file. The team is evaluating mitigations. Which mitigation is most effective in reducing the risk of token theft?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Threat Modeling CASEJAVA Practice Questions (Page 2)

Questions 6–10

Which STRIDE threat category is primarily concerned with an attacker being able to modify data or code?

A security team has completed a threat model for a Java application and needs to communicate the findings to a non-technical executive audience. The goal is to secure funding for mitigation efforts. Which approach is most effective for this communication?

What is the main purpose of prioritizing threats in threat modeling?

A team is threat modeling a Java application that uses a third-party payment gateway. The application sends payment data to the gateway via an API. The team is identifying assets and entry points. Which of the following is the most critical asset to protect in this scenario?

Keep studying — Security Requirements and Secure Design