Threat Modeling CASENET Practice Questions (Page 11)

Questions 51–52

1. 51application · medium

   A development team is adopting threat modeling for an existing .NET application. They want to integrate it into their CI/CD pipeline without slowing down releases. Which approach best achieves this?

   • APerform a full threat modeling session at the start of each sprint and document results in the backlog.
   • BUse a threat modeling tool only during the design phase of new features, not for existing code.
   • CRun an automated threat modeling tool that generates a DFD from the code and flags high-risk patterns in each build.
   • DConduct a one-time threat modeling workshop and then rely on code reviews for new features.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   In a data flow diagram, which symbol is typically used to represent an external entity that interacts with the system?

   • AA rectangle with a label such as 'User' or 'External System'
   • BA circle or oval
   • CA rectangle with rounded corners
   • DA rectangle
   Reveal Solution Discussion Select an answer first