Threat Modeling and Vulnerability Assessment CSE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security architect is threat modeling a cloud-native application that uses microservices. The architect needs to identify threats related to service-to-service communication. Which threat modeling approach is most suitable for this task?

   • AAttack trees, focusing on the root goal of data exfiltration
   • BCVSS scoring of known vulnerabilities
   • CPASTA, starting with business objectives
   • DSTRIDE, applied to each data flow between microservices
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key feature of OpenVAS as a vulnerability scanning tool?

   • AIt is a proprietary tool that requires a paid license
   • BIt is primarily used for network traffic analysis
   • CIt is a cloud-based service that only scans web applications
   • DIt is an open-source vulnerability scanner that can be used to detect weaknesses in cloud infrastructure
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A vulnerability scan identifies a medium-severity vulnerability in a cloud-based application. The vulnerability is not currently exploitable due to network segmentation, but the segmentation is scheduled to be removed next month. What should the security team do?

   • APrioritize remediation before the segmentation is removed
   • BIncrease the vulnerability's severity to critical
   • CDefer remediation until the vulnerability becomes exploitable
   • DIgnore the vulnerability because it is medium severity
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is migrating a legacy three-tier application to AWS. The security team is conducting a threat modeling exercise using STRIDE. They are analyzing the data flow between the web tier and the database tier. Which STRIDE category is most directly relevant to the risk of an attacker modifying SQL queries sent from the web tier to the database?

   • ASpoofing
   • BDenial of Service
   • CTampering
   • DInformation Disclosure
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When prioritizing vulnerabilities for remediation, which factor is most important to consider?

   • AThe ease of exploitation for the attacker
   • BThe number of systems affected
   • CThe severity score and the potential impact on the business
   • DThe age of the vulnerability
   Reveal Solution Discussion Select an answer first