Threat Modeling CASEJAVA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A Java application uses a REST API that accepts JSON payloads. The threat model identifies a risk of an attacker sending malformed JSON to cause the application to crash. Which mitigation strategy is most appropriate?

   • AAdd a WAF to filter out malicious requests.
   • BUse HTTPS to encrypt the JSON payloads in transit.
   • CIncrease the server's memory to handle larger payloads.
   • DImplement strict input validation and schema validation for JSON payloads.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team is prioritizing threats for a Java web application. They have identified two threats: Threat A allows an unauthenticated attacker to read the database connection string, and Threat B requires physical access to the server to read log files. Using DREAD, which threat should be prioritized as higher risk?

   • ANeither threat should be prioritized because DREAD is not a valid risk assessment technique.
   • BThreat A, because it has higher damage potential and is easier to exploit remotely.
   • CBoth threats are equal because they both result in information disclosure.
   • DThreat B, because physical access implies the attacker already has high privileges.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which risk assessment technique uses a rating system to calculate a risk score based on factors like Damage, Reproducibility, Exploitability, Affected users, and Discoverability?

   • ACVSS
   • BDREAD
   • CSTRIDE
   • DPASTA
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a typical output of application decomposition in threat modeling?

   • AA list of vulnerabilities found in the code
   • BA set of security requirements for the application
   • CA test plan for penetration testing
   • DA list of all external entities and their trust levels
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A Java application has a feature that allows users to export their data as a CSV file. The export process reads data from a database and writes it to a file that is then downloaded by the user. During threat modeling, the team identifies that a user could manipulate the export parameters to include data from other users. Which STRIDE category does this threat belong to, and what is the best mitigation?

   • ADenial of Service — limit the size of the export file to prevent resource exhaustion.
   • BTampering — validate and sanitize the export parameters to prevent injection attacks.
   • CInformation Disclosure — implement server-side authorization checks to ensure users can only export their own data.
   • DSpoofing — require strong authentication for the export feature.
   Reveal Solution Discussion Select an answer first