Threat Modeling CASENET Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which stakeholders should be involved in the threat modeling process to ensure security requirements are addressed?

   • AOnly the development team
   • BOnly the project manager
   • CSecurity team, developers, architects, and product owners
   • DOnly the security team
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security team wants to adopt a threat modeling tool for their .NET projects. They need the tool to integrate with Azure DevOps and automatically generate DFDs from the code. Which tool capability is most important to evaluate?

   • AThe ability to export reports in PDF format.
   • BSupport for importing code and creating data flow diagrams automatically.
   • CThe ability to run on a local machine without internet access.
   • DA large library of threat templates for various technologies.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   In the threat modeling process, what is the role of identifying trust boundaries?

   • ATo identify the encryption algorithms used to protect data at rest
   • BTo list all the external users who are allowed to access the application
   • CTo determine where data crosses from one level of trust to another, which helps identify where security controls are needed
   • DTo define the physical boundaries of the data center where the application is hosted
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which STRIDE category is primarily concerned with an attacker gaining higher privileges than they are authorized to have?

   • ATampering
   • BElevation of Privilege
   • CDenial of Service
   • DInformation Disclosure
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A development team is adopting threat modeling for the first time. They want to integrate it into their existing Agile sprints without slowing down delivery. The team has a small security budget and limited security expertise. Which approach best balances security value with development velocity?

   • APerform a full threat model once at the end of the project before release.
   • BHire a dedicated security consultant to threat model every feature in every sprint.
   • CConduct a lightweight threat modeling session at the start of each sprint for new features, focusing on high-risk changes.
   • DSkip threat modeling and rely on penetration testing after each release.
   Reveal Solution Discussion Select an answer first