Threat Modeling CASEJAVA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A team is identifying assets for a Java-based healthcare application. They have listed the following: patient records, the login page, the database server, and the API endpoint. Which of these is the most critical asset to protect?

   • AThe API endpoint
   • BThe login page
   • CThe database server
   • DPatient records
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is a key consideration when communicating threat modeling findings to non-technical stakeholders?

   • AShare the full threat model document with all stakeholders
   • BFocus on the business impact and risk in terms they can understand
   • CProvide a detailed list of all vulnerabilities with CVSS scores
   • DAvoid discussing threats to prevent panic
   Reveal Solution Discussion Select an answer first
4. 38application · easy

   A development team has identified several threats in a Java application. They want to prioritize them using a quantitative approach that considers exploitability, impact, and other factors. Which of the following is the most appropriate technique?

   • ASTRIDE
   • BPASTA
   • CCVSS
   • DAttack trees
   Reveal Solution Discussion Select an answer first
5. 39application · easy

   A security team is using DREAD to score a threat. They have assigned the following scores: Damage = 9, Reproducibility = 8, Exploitability = 7, Affected Users = 6, Discoverability = 5. What is the overall DREAD score?

   • A9.0
   • B8.0
   • C7.0
   • D6.5
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A Java-based e-commerce application allows users to upload profile pictures. The development team is performing threat modeling and has identified that an attacker could upload a malicious file that gets executed on the server. Which STRIDE category does this threat primarily fall under, and what is the most appropriate mitigation?

   • ATampering — use a content security policy to prevent the uploaded file from being rendered in the browser.
   • BElevation of Privilege — enforce strict file type validation and store uploads outside the web root with random filenames.
   • CDenial of Service — limit the file size and rate-limit upload requests to prevent resource exhaustion.
   • DInformation Disclosure — encrypt the uploaded files at rest to prevent attackers from reading them.
   Reveal Solution Discussion Select an answer first