Integrating Threat Modeling in the Plan Stage DSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A team is conducting a threat modeling exercise for a new online payment system. They have identified the assets, created data flow diagrams, and enumerated potential threats. What is the next step in the threat modeling process?

   • ADeploy the system to production to test the threats
   • BImmediately start coding to fix the threats
   • CPrioritize the threats and define mitigations for the highest-risk items
   • DDelete the threat list and start over with a different methodology
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   After a threat-modeling session, a security analyst has identified a critical threat in a new authentication service. The team uses a Scrum process. What is the most effective way to communicate the threat and its mitigation to the development team so it is actually addressed?

   • AAdd a user story to the product backlog with the threat description and acceptance criteria for the mitigation.
   • BCreate a wiki page with the threat model and ask developers to read it on their own time.
   • CInclude the threat in the security team's internal report and present it at the next quarterly review.
   • DSend a detailed email to the development team and ask them to review it before the next sprint.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A DevSecOps team is selecting a threat modeling tool for their organization. They need a tool that supports multiple methodologies, provides a central repository for threat models, and integrates with their existing development tools. Which tool should they choose?

   • AIriusRisk
   • BThreatModeler
   • COWASP Threat Dragon
   • DMicrosoft Threat Modeling Tool
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Who should be involved in threat modeling activities during the plan stage?

   • AOnly the project manager
   • BSecurity team, developers, and operations stakeholders
   • COnly the development team
   • DOnly the security team
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A DevSecOps team is about to start the plan stage for a new microservices-based application. The security lead wants to ensure that threat modeling is integrated early and effectively. Which action best aligns with integrating threat modeling into the plan stage?

   • AWait until the system is in production to perform threat modeling based on real attack data
   • BConduct a collaborative threat modeling session during the planning phase with developers, architects, and security
   • CSchedule a threat modeling workshop after the code is written but before deployment
   • DInvolve only the security team in the threat modeling session to avoid bias
   Reveal Solution Discussion Select an answer first