A security lead is choosing a threat modeling methodology for a new .NET microservices project. The team needs to compare threats based on risk and prioritize fixes. Which methodology is best suited for this?

STRIDE, because it categorizes threats by type and is easy to apply to each data flow.

DREAD, because it scores each threat on damage, reproducibility, exploitability, affected users, and discoverability.

Attack trees, because they show how multiple attack steps can lead to a goal.

Brainstorming, because it is the fastest way to generate a list of threats.

A threat modeling team is using STRIDE to analyze a .NET web service that accepts JSON payloads. They want to ensure they don't miss threats. Which technique is most effective for identifying a broad set of threats?

Reviewing only the authentication and authorization code.

Using a checklist of common vulnerabilities like OWASP Top 10.

Applying STRIDE to each data flow in the DFD.

Brainstorming with the development team without any structure.

Which statement best describes a key benefit of performing threat modeling during the design phase of an application?

It ensures the application will meet all regulatory compliance requirements

It guarantees that the application will be free of all security vulnerabilities

It eliminates the need for other security testing activities such as code review and penetration testing

It helps identify security issues early, when they are typically less expensive to fix

Which mitigation strategy is most appropriate for a threat where an attacker could modify data stored in a database?

Enforcing strong password policies

Implementing integrity controls such as checksums or digital signatures

Which of the following is an example of a structured approach to identifying threats?

Using a model like STRIDE to systematically examine each interaction in the system

Asking a group of developers to freely suggest any potential security issues they can think of

Reviewing the application's user manual to find potential misuse cases

Waiting for the security team to report vulnerabilities after penetration testing

EC-CouncilCertified Application Security Engineer (.NET)

Domain 2Objective 5

Threat Modeling CASENET Practice Questions (Page 1)

Part of the Security Requirements and Secure Design domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 2–2 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 1–5

1application · medium
A security lead is choosing a threat modeling methodology for a new .NET microservices project. The team needs to compare threats based on risk and prioritize fixes. Which methodology is best suited for this?
Select an answer first
2application · medium
A threat modeling team is using STRIDE to analyze a .NET web service that accepts JSON payloads. They want to ensure they don't miss threats. Which technique is most effective for identifying a broad set of threats?
Select an answer first
3foundation · easy
Which statement best describes a key benefit of performing threat modeling during the design phase of an application?
Select an answer first
4foundation · easy
Which mitigation strategy is most appropriate for a threat where an attacker could modify data stored in a database?
Select an answer first
5foundation · easy
Which of the following is an example of a structured approach to identifying threats?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.