Integrating Threat Modeling in the Plan Stage DSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A DevSecOps team is threat modeling a new payment processing system. They need to prioritize threats based on business impact and likelihood, but they also need to communicate the results to non-technical stakeholders. Which combination of methodologies would best meet these needs?

   • AUse PASTA alone, because it includes business impact analysis.
   • BUse STRIDE to identify threats, then use DREAD to score them for prioritization.
   • CUse CVSS to score vulnerabilities, then use STRIDE to categorize them.
   • DUse DREAD to identify threats, then use STRIDE to categorize them.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A DevSecOps team is about to start a new project. The project manager asks why they should invest time in threat modeling during the plan stage instead of waiting until after the code is written. Which response best justifies the investment?

   • AThreat modeling guarantees that the application will be free of vulnerabilities after deployment.
   • BThreat modeling is required by the PCI DSS standard for all applications.
   • CThreat modeling replaces the need for security testing later in the pipeline.
   • DThreat modeling in the plan stage helps identify security requirements early, reducing the cost of fixes and preventing design flaws.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which tool is commonly used for threat modeling and is known for its data flow diagram (DFD) based approach?

   • ABurp Suite
   • BNessus
   • CMicrosoft Threat Modeling Tool
   • DOWASP ZAP
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A DevSecOps team is adopting threat modeling for a new payment-processing microservice. The team needs a methodology that will help them prioritize which threats to address first based on a calculated risk score, and they want to involve stakeholders in a structured brainstorming session during the plan stage. Which approach best meets these needs?

   • AUse PASTA alone because it is the only methodology that includes stakeholder brainstorming.
   • BUse STRIDE to categorize threats, then apply DREAD to score and rank them for the backlog.
   • CUse STRIDE only, because it provides both threat categories and a built-in risk-scoring system.
   • DUse DREAD to identify threats, then use STRIDE to assign a severity rating to each threat.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst has completed a threat model for a new web application. The threat model identifies a high-risk threat that requires a design change. The development team is already in the middle of the sprint. What is the best way to communicate this threat to ensure it is addressed?

   • ALog the threat in a security findings spreadsheet and review it at the end of the quarter.
   • BDiscuss the threat in the daily stand-up and ask the team to address it immediately.
   • CSend an email to the development team with the threat details and ask them to fix it in the current sprint.
   • DEscalate to the product owner and add a spike or design task to the next sprint.
   Reveal Solution Discussion Select an answer first