A threat modeling team is using STRIDE to analyze a .NET application that uses a third-party payment gateway. They want to identify threats related to the integration. Which technique is most effective?

Use a generic checklist of threats for all web applications.

Brainstorm with the team without any structure.

Apply STRIDE to the data flow between the application and the payment gateway.

Review the payment gateway's documentation for known vulnerabilities.

Why is it important to prioritize threats in threat modeling?

To document threats for compliance purposes only

To ensure all threats are mitigated equally

To focus mitigation efforts on the most significant risks first

To eliminate the need for security testing

A .NET application exposes an API endpoint that returns user profile data. During threat modeling, the team identifies that an attacker could enumerate other users' profiles by changing the user ID in the request. Which STRIDE category does this threat represent, and what is the best mitigation?

Denial of service — add rate limiting to the API endpoint.

Spoofing — require the user to re-authenticate for each request.

Tampering — validate that the user ID is a number.

Information disclosure — implement proper authorization checks to ensure the user can only access their own data.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 2Objective 5

Threat Modeling CASENET Practice Questions (Page 7)

Part of the Security Requirements and Secure Design domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 2–2 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 31–35

31application · medium
A threat modeling team is using STRIDE to analyze a .NET application that uses a third-party payment gateway. They want to identify threats related to the integration. Which technique is most effective?
Select an answer first
32foundation · easy
Which threat modeling methodology uses a tree structure to represent an attacker's goals and the various ways to achieve them?
Select an answer first
33foundation · easy
Why is it important to prioritize threats in threat modeling?
Select an answer first
34application · medium
A .NET application exposes an API endpoint that returns user profile data. During threat modeling, the team identifies that an attacker could enumerate other users' profiles by changing the user ID in the request. Which STRIDE category does this threat represent, and what is the best mitigation?
Select an answer first
35foundation · easy
When prioritizing threats, which two factors are most commonly used to assess risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Threat Modeling CASENET Practice Questions (Page 7)

Questions 31–35

A threat modeling team is using STRIDE to analyze a .NET application that uses a third-party payment gateway. They want to identify threats related to the integration. Which technique is most effective?

Which threat modeling methodology uses a tree structure to represent an attacker's goals and the various ways to achieve them?

Why is it important to prioritize threats in threat modeling?

A .NET application exposes an API endpoint that returns user profile data. During threat modeling, the team identifies that an attacker could enumerate other users' profiles by changing the user ID in the request. Which STRIDE category does this threat represent, and what is the best mitigation?

When prioritizing threats, which two factors are most commonly used to assess risk?

Keep studying — Security Requirements and Secure Design