Threat Modeling and Vulnerability Assessment CSE Practice Questions (Page 10)

Questions 46–48

1. 46foundation · easy

   Which threat modeling framework categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

   • ASTRIDE
   • BCVSS
   • CAttack trees
   • DPASTA
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security architect is choosing a threat modeling methodology for a cloud-native application that uses serverless functions, managed databases, and API gateways. The team needs to identify threats early in the development lifecycle and also assess the risk of each threat. Which methodology is best suited for this scenario?

   • ACVSS, because it provides a numerical score for vulnerabilities.
   • BAttack trees, because they are easy to create and understand.
   • CPASTA, because it provides a structured process that includes risk analysis and aligns with the development lifecycle.
   • DSTRIDE, because it is simple and easy to apply to any system.
   Reveal Solution Discussion Select an answer first
3. 48application · medium

   A cloud architect is using the PASTA threat modeling methodology to assess a new microservices-based application. The team has already defined the scope and identified potential attack vectors. What is the next step in the PASTA process?

   • ADecompose the application into its components and trust boundaries.
   • BDevelop a list of mitigations and countermeasures for each identified threat.
   • CAnalyze the application's architecture and data flows to identify vulnerabilities.
   • DSimulate attacks against the application to validate the threat model.
   Reveal Solution Discussion Select an answer first