In a typical threat modeling process, which step immediately follows the identification of assets?

Conducting a penetration test on the system

Implementing mitigations for all identified threats

Deploying the application to production

Identifying potential threats to those assets

A threat modeling workshop has identified a critical vulnerability in a new authentication service. The development team lead is skeptical of the finding and wants to deprioritize it. The security analyst needs to communicate the threat effectively. What is the most effective approach?

Escalate the issue to management without discussing it with the team lead

Send a detailed technical report to the team lead and hope they read it

Agree with the team lead to avoid conflict and move on

Present the threat with a clear risk rating and a concrete mitigation plan, and explain the potential business impact

A DevSecOps team is conducting a threat-modeling session for a new microservices-based application. They have created a data flow diagram and identified the assets. What should they do next in the threat-modeling process?

Identify potential threats to each component and data flow, then determine mitigations.

Validate the data flow diagram with the security team before proceeding.

Assign a CVSS score to each asset to prioritize them.

Immediately implement security controls for all identified assets.

EC-CouncilDevSecOps Essentials

Domain 5Objective 1

Integrating Threat Modeling in the Plan Stage DSE Practice Questions (Page 3)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 11–15

11application · medium
A security architect is evaluating threat modeling methodologies for a large, complex system that requires a thorough, business-driven approach with detailed risk analysis. The team has time and resources to invest in a comprehensive process. Which methodology is most appropriate?
Select an answer first
12foundation · easy
In a typical threat modeling process, which step immediately follows the identification of assets?
Select an answer first
13expert · hard
A threat modeling workshop has identified a critical vulnerability in a new authentication service. The development team lead is skeptical of the finding and wants to deprioritize it. The security analyst needs to communicate the threat effectively. What is the most effective approach?
Select an answer first
14application · medium
A DevSecOps team is conducting a threat-modeling session for a new microservices-based application. They have created a data flow diagram and identified the assets. What should they do next in the threat-modeling process?
Select an answer first
15foundation · easy
Which threat modeling methodology is primarily focused on evaluating the risk of threats using factors such as Damage, Reproducibility, Exploitability, Affected users, and Discoverability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.

Integrating Threat Modeling in the Plan Stage DSE Practice Questions (Page 3)

Questions 11–15

A security architect is evaluating threat modeling methodologies for a large, complex system that requires a thorough, business-driven approach with detailed risk analysis. The team has time and resources to invest in a comprehensive process. Which methodology is most appropriate?

In a typical threat modeling process, which step immediately follows the identification of assets?

A threat modeling workshop has identified a critical vulnerability in a new authentication service. The development team lead is skeptical of the finding and wants to deprioritize it. The security analyst needs to communicate the threat effectively. What is the most effective approach?

A DevSecOps team is conducting a threat-modeling session for a new microservices-based application. They have created a data flow diagram and identified the assets. What should they do next in the threat-modeling process?

Which threat modeling methodology is primarily focused on evaluating the risk of threats using factors such as Damage, Reproducibility, Exploitability, Affected users, and Discoverability?

Keep studying — Implementing DevSecOps Testing and Threat Modeling