A threat modeling session has just concluded, and the team has identified several threats and agreed on mitigations. What is the most important next step to ensure the mitigations are implemented?

Wait for the security team to fix all the issues themselves

Assign owners and deadlines for each mitigation and track them in the project management tool

Delete the threat model to avoid overwhelming the team

Archive the threat model document and move on to the next project

A security team is evaluating threat modeling tools for a project that uses a microservices architecture. They need a tool that can automatically generate threat models from the architecture diagrams and support continuous updates as the architecture evolves. Which tool feature is most important?

A large library of predefined threat templates

Integration with architecture modeling tools and automated threat generation

A user-friendly interface for manual threat entry

A DevSecOps team is planning a new feature that will allow users to upload profile pictures. The team wants to conduct a quick threat-modeling exercise during the sprint planning meeting. Which activity is most appropriate for this time-boxed session?

Create a detailed threat model document and circulate it for review.

Defer threat modeling to the security team after the feature is developed.

Conduct a full PASTA analysis with all stakeholders.

Brainstorm potential threats using STRIDE categories and note them as backlog items.

A company is moving from a waterfall to a DevSecOps model. The security team is used to doing threat modeling at the end of the design phase. The new DevSecOps lead wants to integrate threat modeling into the plan stage. What is the most important change to make?

Shift threat modeling to the beginning of the planning phase and make it a collaborative, iterative activity

Replace threat modeling with automated security scanning tools

Use a different threat modeling methodology

Involve the security team only in the plan stage and not in later stages

Which of the following is an effective way to communicate identified threats to relevant team members?

Post the threats on a public website

Create a threat model report and share it in a team meeting

Only communicate threats to the security team

Keep the threats confidential to avoid panic

EC-CouncilDevSecOps Essentials

Domain 5Objective 1

Integrating Threat Modeling in the Plan Stage DSE Practice Questions (Page 5)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 21–25

21application · medium
A threat modeling session has just concluded, and the team has identified several threats and agreed on mitigations. What is the most important next step to ensure the mitigations are implemented?
Select an answer first
22expert · hard
A security team is evaluating threat modeling tools for a project that uses a microservices architecture. They need a tool that can automatically generate threat models from the architecture diagrams and support continuous updates as the architecture evolves. Which tool feature is most important?
Select an answer first
23application · medium
A DevSecOps team is planning a new feature that will allow users to upload profile pictures. The team wants to conduct a quick threat-modeling exercise during the sprint planning meeting. Which activity is most appropriate for this time-boxed session?
Select an answer first
24expert · hard
A company is moving from a waterfall to a DevSecOps model. The security team is used to doing threat modeling at the end of the design phase. The new DevSecOps lead wants to integrate threat modeling into the plan stage. What is the most important change to make?
Select an answer first
25foundation · easy
Which of the following is an effective way to communicate identified threats to relevant team members?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.