Threat Modeling CASENET Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A project manager asks why the team should invest time in threat modeling for a .NET application that is already in development. The team has not done threat modeling before. Which response best explains the value of threat modeling at this stage?

   • AIt guarantees the application will be free of all security vulnerabilities.
   • BIt replaces the need for penetration testing and code review.
   • CIt helps identify design-level security issues early, when they are cheaper to fix than after deployment.
   • DIt is a required step for all software development, regardless of the project.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is it important to integrate threat modeling into the early stages of the software development lifecycle?

   • ATo reduce the need for developer training on security
   • BTo ensure security requirements are considered before the architecture is finalized
   • CTo ensure the application is deployed faster
   • DTo eliminate the need for security testing in later phases
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A threat modeling facilitator is comparing STRIDE and DREAD for a .NET application. They want to use one methodology to both identify and prioritize threats. Which approach is most effective?

   • AUse attack trees, because they both identify and prioritize threats.
   • BUse only DREAD, because it identifies threats and prioritizes them.
   • CUse only STRIDE, because it provides a risk score for each threat.
   • DUse STRIDE to identify threats and then DREAD to prioritize them.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A team is creating a data flow diagram (DFD) for a new ASP.NET Core web API. The API receives requests from a public-facing Angular SPA, validates them, and queries a SQL database. The DFD correctly shows the SPA, the API, and the database as processes, with arrows representing data flows. During review, the team notices that the arrow between the SPA and the API is labeled 'HTTPS'. What critical element is missing from this DFD to make it useful for threat identification?

   • AA trust boundary separating the user's browser from the API server.
   • BAn external entity for the database administrator.
   • CA second arrow showing the database's response flow back to the API.
   • DA data store for the SPA's local browser cache.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A .NET team uses a threat modeling tool that integrates with their CI/CD pipeline. The tool automatically generates a DFD and flags potential threats on every code commit. The team is overwhelmed by the volume of alerts and is experiencing alert fatigue. What is the most effective way to reduce noise while maintaining security value?

   • AAutomatically dismiss all low-severity alerts without review.
   • BRun the tool only once per release, not on every commit.
   • CDisable the tool's threat detection and only use it for DFD generation.
   • DConfigure the tool to run only on pull requests that touch security-sensitive components, and require manual triage of results.
   Reveal Solution Discussion Select an answer first