Threat Modeling and Vulnerability Assessment CSE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company is migrating a legacy web application to AWS. The security team is conducting a threat modeling exercise using STRIDE. They are focusing on the application's authentication mechanism, which uses a shared secret embedded in the client code. Which STRIDE category is most directly applicable to this weakness, and what is the most appropriate initial mitigation?

   • ATampering; implement a web application firewall (WAF) to inspect and filter incoming requests.
   • BInformation disclosure; rotate the embedded secret every 90 days.
   • CSpoofing; replace the embedded secret with a managed identity service such as AWS IAM Identity Center or Amazon Cognito.
   • DDenial of service; add rate limiting to the authentication endpoint.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company uses a cloud provider's managed database service. The provider is responsible for patching the database engine, but the company must manage access controls and data encryption. During a threat modeling session, the team identifies a risk that a former employee's credentials might still be valid. Which shared responsibility gap does this risk highlight?

   • AInadequate identity and access management on the customer side
   • BProvider failure to patch the database engine
   • CMissing network firewall rules
   • DLack of encryption at rest
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security team is using Nessus to scan a cloud environment that includes both Windows and Linux virtual machines. The scan completes and reports several vulnerabilities. The team lead wants to ensure the scan results are accurate and actionable. Which step should the team take?

   • AVerify that the scan credentials were correct and that the scan covered all intended hosts.
   • BRun the scan again with the default settings to confirm the results.
   • CImmediately patch all vulnerabilities reported by the scan.
   • DIgnore the results because Nessus is known to produce false positives.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security analyst is creating an attack tree for a cloud-based customer relationship management (CRM) system. The root goal is 'attacker gains access to customer data.' Which of the following is a valid child node in the attack tree?

   • AExploit a SQL injection vulnerability in the web application
   • BConfigure the firewall with default rules
   • CMonitor network traffic for anomalies
   • DPerform a routine backup of the database
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A large enterprise is migrating a critical application to the cloud. The security team must choose a threat modeling methodology. They need to align threat modeling with business objectives and provide a risk-centric view that can be used by executives. They also need to trace threats to specific attack paths. Which methodology best fits these requirements?

   • AAttack trees
   • BPASTA
   • CCVSS scoring
   • DSTRIDE
   Reveal Solution Discussion Select an answer first