A DevSecOps team is planning a new feature that will handle personal data. The compliance officer requires that threat modeling be integrated into the plan stage, but the team is already overloaded. The team lead wants to minimize the impact on the team's workload while still meeting the compliance requirement. What is the best approach?

Ask the compliance officer to perform the threat modeling

Conduct a full threat modeling exercise with all team members

Integrate a lightweight threat modeling step into the existing planning meetings, focusing on the new feature's data flows

Document that threat modeling was considered but not performed due to workload

When should threat modeling activities be incorporated into the DevSecOps pipeline?

Only when a security incident occurs

During the testing phase, just before release

After the application is deployed to production

During the plan stage, before development begins

A company is adopting DevSecOps and wants to introduce threat modeling in the plan stage. The security manager needs to justify the investment to management. Which benefit of threat modeling should the manager emphasize?

It guarantees that all vulnerabilities will be eliminated before release

It replaces the need for penetration testing and other security testing

It reduces the cost of fixing security issues by identifying them early in the design phase

It is a mandatory compliance requirement for all software development

EC-CouncilDevSecOps Essentials

Domain 5Objective 1

Integrating Threat Modeling in the Plan Stage DSE Practice Questions (Page 8)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 36–39

36expert · hard
A DevSecOps team is planning a new feature that will handle personal data. The compliance officer requires that threat modeling be integrated into the plan stage, but the team is already overloaded. The team lead wants to minimize the impact on the team's workload while still meeting the compliance requirement. What is the best approach?
Select an answer first
37foundation · easy
When should threat modeling activities be incorporated into the DevSecOps pipeline?
Select an answer first
38foundation · easy
Which threat modeling methodology categorizes threats into categories such as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?
Select an answer first
39application · medium
A company is adopting DevSecOps and wants to introduce threat modeling in the plan stage. The security manager needs to justify the investment to management. Which benefit of threat modeling should the manager emphasize?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.

Integrating Threat Modeling in the Plan Stage DSE Practice Questions (Page 8)

Questions 36–39

When should threat modeling activities be incorporated into the DevSecOps pipeline?

Which threat modeling methodology categorizes threats into categories such as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

A company is adopting DevSecOps and wants to introduce threat modeling in the plan stage. The security manager needs to justify the investment to management. Which benefit of threat modeling should the manager emphasize?

Keep studying — Implementing DevSecOps Testing and Threat Modeling