Integrating Threat Modeling in the Plan Stage DSE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A DevSecOps team is planning a major update to a legacy system. The security team wants to conduct a thorough threat modeling exercise, but the development team is concerned that it will delay the release. Management has mandated that the update must be delivered on time. How should the team proceed?

   • AAsk the security team to do the threat modeling alone without involving the development team
   • BSkip threat modeling for this release and do it after the update
   • CPerform a lightweight threat modeling focused on the highest-risk changes and integrate it into the existing planning process
   • DConduct a full threat modeling exercise and accept the delay
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A startup is building a new mobile app and wants to adopt DevSecOps practices. The team is small and has limited security expertise. They want to start threat modeling in the plan stage but are unsure how to begin. What is the most practical first step?

   • ASkip threat modeling and rely on penetration testing later
   • BAdopt a complex methodology like PASTA immediately
   • CHire a full-time security expert to lead all threat modeling efforts
   • DUse a simple checklist-based approach to identify common threats
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of documenting threats identified during threat modeling?

   • ATo automate the mitigation of all identified threats
   • BTo provide a reference for developers and stakeholders to understand and address the threats
   • CTo replace the need for security testing
   • DTo satisfy regulatory compliance requirements only
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A DevSecOps team is threat modeling a legacy monolithic application that is being migrated to a microservices architecture. They want to identify threats that are specific to the new architecture, such as service-to-service authentication and data exposure between services. Which methodology would be most effective?

   • AAttack trees, because they can model attacks on the entire system.
   • BSTRIDE, because it can be applied to each service and the interactions between them.
   • CCVSS, because it can score vulnerabilities in each service.
   • DDREAD, because it provides a risk score for each service.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of threat modeling in the plan stage of a DevSecOps pipeline?

   • ATo automate the deployment of security patches to production environments
   • BTo perform penetration testing on the final application before release
   • CTo monitor application logs for security incidents after deployment
   • DTo identify potential security threats and design mitigations early in the development lifecycle
   Reveal Solution Discussion Select an answer first