What is a key benefit of using automated threat modeling tools?

They can completely replace the need for human security expertise

They guarantee that all threats are automatically mitigated

They help standardize the process and document threats consistently

They eliminate the need for data flow diagrams

A project manager asks why threat modeling is needed for a small internal .NET tool that only runs on the company network. Which response best explains the value of threat modeling?

It replaces the need for penetration testing.

It guarantees the application will be free of vulnerabilities.

It is only useful for internet-facing applications.

It helps identify potential attack vectors and design mitigations early, reducing the cost of fixes.

A team is starting threat modeling for a new .NET application. They have identified assets and entry points. What is the next step in the systematic threat modeling process?

Select mitigation strategies before identifying threats.

Immediately brainstorm potential threats without a diagram.

Create a data flow diagram to visualize how data moves through the system.

Deploy the application to a test environment to observe real attacks.

A team is creating a DFD for a .NET MVC application that uses a SQL Server database. They want to identify where threats could be introduced. Which element in the DFD should be explicitly marked as a trust boundary?

The data flow between the web server and the database server.

The external entity representing the end user's browser.

The data store representing the SQL Server database.

The process representing the web application's business logic.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 2Objective 5

Threat Modeling CASENET Practice Questions (Page 8)

Part of the Security Requirements and Secure Design domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 2–2 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 36–40

36foundation · easy
What is a key benefit of using automated threat modeling tools?
Select an answer first
37application · medium
A project manager asks why threat modeling is needed for a small internal .NET tool that only runs on the company network. Which response best explains the value of threat modeling?
Select an answer first
38application · medium
A team is starting threat modeling for a new .NET application. They have identified assets and entry points. What is the next step in the systematic threat modeling process?
Select an answer first
39foundation · easy
Which technique for identifying threats relies on a predefined list of common threat categories or patterns?
Select an answer first
40application · medium
A team is creating a DFD for a .NET MVC application that uses a SQL Server database. They want to identify where threats could be introduced. Which element in the DFD should be explicitly marked as a trust boundary?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.