Which of the following is a common feature of threat modeling tools?

Data flow diagram creation and analysis

A .NET team uses a threat modeling tool that auto-generates a data flow diagram from the codebase and flags potential threats based on common patterns. After running the tool, the team finds several false positives. What is the most effective way to use the tool's output in their workflow?

Use the tool's output as a starting point, manually review each flagged threat, and document decisions in the tool.

Disable the tool's threat detection and only use it for diagram generation.

Automatically fix all flagged threats without review to save time.

Ignore the tool's output and rely solely on manual threat modeling.

What is the primary purpose of the DREAD methodology in threat modeling?

To rate and prioritize threats based on risk factors

To categorize threats into six distinct types

To model attacker goals and paths in a tree structure

To create data flow diagrams of the application

A .NET application has two identified threats: (1) an unauthenticated attacker can cause a denial of service by sending many large requests, and (2) an authenticated low-privilege user can access admin functions due to a missing authorization check. The team must prioritize one for immediate mitigation. Threat 1 has a high likelihood but low impact (service degradation). Threat 2 has a low likelihood (requires an authenticated user) but high impact (full admin access). Which threat should be prioritized, and what is the most defensible rationale?

Threat 1, because it is easier to mitigate with rate limiting.

Threat 2, because the impact of full admin access is severe, and the likelihood is not zero; a risk-based approach weighs impact heavily.

Threat 1, because it has a higher likelihood and can be exploited by anyone.

Threat 2, because it is a known vulnerability with a clear fix.

What is the primary purpose of a data flow diagram (DFD) in threat modeling?

To document the project's timeline and milestones

To list all the hardware components of the application server

To visually represent how data moves through the application, helping identify where threats may occur

To show the organizational structure of the development team

EC-CouncilCertified Application Security Engineer (.NET)

Domain 2Objective 5

Threat Modeling CASENET Practice Questions (Page 3)

Part of the Security Requirements and Secure Design domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 2–2 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 11–15

11foundation · easy
Which of the following is a common feature of threat modeling tools?
Select an answer first
12application · medium
A .NET team uses a threat modeling tool that auto-generates a data flow diagram from the codebase and flags potential threats based on common patterns. After running the tool, the team finds several false positives. What is the most effective way to use the tool's output in their workflow?
Select an answer first
13foundation · easy
What is the primary purpose of the DREAD methodology in threat modeling?
Select an answer first
14expert · hard
A .NET application has two identified threats: (1) an unauthenticated attacker can cause a denial of service by sending many large requests, and (2) an authenticated low-privilege user can access admin functions due to a missing authorization check. The team must prioritize one for immediate mitigation. Threat 1 has a high likelihood but low impact (service degradation). Threat 2 has a low likelihood (requires an authenticated user) but high impact (full admin access). Which threat should be prioritized, and what is the most defensible rationale?
Select an answer first
15foundation · easy
What is the primary purpose of a data flow diagram (DFD) in threat modeling?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.