A DevSecOps team is planning a new customer-facing API. They want to identify potential threats early, but they are concerned that holding a full threat-modeling workshop with all stakeholders will slow down the planning phase. Which approach best balances early threat identification with planning efficiency?

Conduct a lightweight threat-modeling session with the security lead, architect, and product owner, then document findings in the backlog.

Ask the security team to produce a threat model without involving the development team, to avoid disrupting the planning meeting.

Defer threat modeling until after the first sprint so the team can show progress to management.

Run a full PASTA analysis with all stakeholders, even though it may take several days.

A DevSecOps team is planning a new feature that will allow users to upload files. The team wants to integrate threat modeling into the plan stage. Which activity should be performed during the plan stage?

Review the code for vulnerabilities after it is written

Create a data flow diagram and identify potential threats to the file upload feature

Deploy the feature to a staging environment and monitor for attacks

Run a dynamic application security test (DAST) against the production environment

A security analyst is comparing STRIDE and DREAD for a new project. The analyst wants to use STRIDE for threat identification and DREAD for risk assessment. Which statement correctly describes how these methodologies can be combined?

STRIDE can be used to identify threats, and DREAD can then be used to score and prioritize them

STRIDE should be used only for network threats, and DREAD only for application threats

STRIDE and DREAD are mutually exclusive and cannot be used together

DREAD is a newer version of STRIDE and should replace it

A DevSecOps team is threat modeling a new API gateway. They have identified several threats, but they are struggling to prioritize them because they have limited resources. They need to focus on the threats that pose the greatest risk to the business. Which approach should they use?

Use VAST to visualize the threats and let the team vote on which to address

Use PASTA to perform a full attack simulation for every threat

Use DREAD to score each threat and prioritize based on the scores

Use STRIDE to categorize the threats and then address them in alphabetical order

What is a key feature to look for when evaluating a threat modeling tool for integration into the planning process?

Ability to automatically patch vulnerabilities in production

Ability to replace the need for manual security reviews

Ability to perform runtime application self-protection

Ability to integrate with version control and issue tracking systems

EC-CouncilDevSecOps Essentials

Domain 5Objective 1

Integrating Threat Modeling in the Plan Stage DSE Practice Questions (Page 6)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 26–30

26application · medium
A DevSecOps team is planning a new customer-facing API. They want to identify potential threats early, but they are concerned that holding a full threat-modeling workshop with all stakeholders will slow down the planning phase. Which approach best balances early threat identification with planning efficiency?
Select an answer first
27application · medium
A DevSecOps team is planning a new feature that will allow users to upload files. The team wants to integrate threat modeling into the plan stage. Which activity should be performed during the plan stage?
Select an answer first
28application · medium
A security analyst is comparing STRIDE and DREAD for a new project. The analyst wants to use STRIDE for threat identification and DREAD for risk assessment. Which statement correctly describes how these methodologies can be combined?
Select an answer first
29expert · hard
A DevSecOps team is threat modeling a new API gateway. They have identified several threats, but they are struggling to prioritize them because they have limited resources. They need to focus on the threats that pose the greatest risk to the business. Which approach should they use?
Select an answer first
30foundation · easy
What is a key feature to look for when evaluating a threat modeling tool for integration into the planning process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.