Threat Modeling and Vulnerability Assessment CSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A vulnerability assessment of a cloud environment is complete. The report lists several vulnerabilities with CVSS scores. The security manager asks which vulnerabilities should be fixed first. What is the most important factor to consider when prioritizing?

   • AThe order in which vulnerabilities were discovered
   • BThe combination of CVSS score, asset criticality, and exploitability
   • CThe number of vulnerabilities in each category
   • DThe CVSS score alone
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is adopting a 'shift-left' security approach and wants to integrate threat modeling into their CI/CD pipeline. The security team is concerned about shared responsibility gaps between the cloud provider and the company. Which action best addresses this concern?

   • AUse a third-party penetration test after each release to identify gaps.
   • BRely on the cloud provider's security certifications to ensure all threats are covered.
   • CConduct a vulnerability scan only after the application is deployed to production.
   • DInclude a threat modeling step in the pipeline that reviews the deployment templates and infrastructure-as-code for misconfigurations.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security team is using attack trees to model threats to a cloud-based payment processing system. They have identified the root goal as 'steal customer payment data'. Which of the following is the most appropriate next step in building the attack tree?

   • ADocument the attack tree in a formal report for management.
   • BIdentify sub-goals and attack vectors that could lead to the root goal, such as exploiting an insecure API or accessing a misconfigured database.
   • CImplement security controls to prevent the root goal from being achieved.
   • DAssign a risk score to the root goal based on the likelihood of a data breach.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which statement best describes the role of threat modeling in cloud security?

   • AIt is a one-time activity performed only at the start of a project
   • BIt replaces the need for vulnerability scanning and penetration testing
   • CIt helps security teams understand and prioritize threats so that appropriate controls can be designed
   • DIt guarantees that all cloud vulnerabilities are eliminated before deployment
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security team has completed a vulnerability assessment of a cloud environment and identified the following findings: (1) a critical vulnerability in a public-facing web application that requires a maintenance window to patch, (2) a high-severity misconfiguration in an S3 bucket that contains sensitive customer data, and (3) a medium-severity vulnerability in an internal application that is not exposed to the internet. The team has limited resources and must prioritize remediation. Which approach is the most effective?

   • APatch the web application first because it has the highest severity, then fix the S3 bucket, and finally address the internal application.
   • BFirst remediate the S3 bucket misconfiguration, then schedule a maintenance window to patch the web application, and finally address the internal application vulnerability.
   • CAddress the internal application first because it is the easiest to fix, then the S3 bucket, and finally the web application.
   • DRemediate all three vulnerabilities simultaneously to reduce the overall risk quickly.
   Reveal Solution Discussion Select an answer first