Threat Modeling CASEJAVA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A security team has completed a threat model for a Java application and needs to communicate the findings to both engineering and executive stakeholders. The engineering team wants detailed technical information, while the executive team wants a high-level summary. Which approach is most effective?

   • AHold a single meeting and verbally explain the technical details, assuming executives will ask questions.
   • BPresent the full technical report to both audiences, assuming they will understand it.
   • CCreate two separate documents: one technical threat model report for engineers and one executive summary with business impact and recommendations.
   • DPresent only the executive summary to both audiences to keep the message simple.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   In a data flow diagram (DFD), what does a circle typically represent?

   • AAn external entity
   • BA data flow
   • CA process
   • DA data store
   Reveal Solution Discussion Select an answer first
4. 43application · easy

   A team is decomposing a Java application for threat modeling. They have identified the following components: a user interface, a business logic layer, a data access layer, and a database. Which of the following is the most appropriate way to represent the data flow between the business logic layer and the data access layer in a DFD?

   • AA data flow arrow labeled with the data being passed.
   • BAn external entity symbol for the data access layer.
   • CA process symbol for each layer.
   • DA data store symbol for the business logic layer.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A Java application allows users to upload profile pictures. The application stores the pictures in a cloud storage bucket and serves them directly to other users. A threat model identifies that an attacker could upload a malicious image that exploits a vulnerability in the image-processing library used by the application. The team is considering mitigations. Which mitigation is most effective in reducing the risk?

   • ARe-encode all uploaded images using a safe image-processing library and store the re-encoded version.
   • BUse a content security policy (CSP) to restrict the types of files that can be served.
   • CStore the images in a private bucket and use signed URLs for access.
   • DDisable the image-processing library and serve images as-is.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the purpose of decomposing an application during threat modeling?

   • ATo simplify the application's code for easier maintenance
   • BTo remove unnecessary features from the application to reduce the attack surface
   • CTo convert the application into a microservices architecture for better scalability
   • DTo break the application into smaller components and data flows to identify potential threats more accurately
   Reveal Solution Discussion Select an answer first