Threat Modeling Concepts ECDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A developer asks why the team should spend time threat modeling when they already use SAST and DAST tools in the pipeline. What is the best response?

   • AThreat modeling is required by the PCI DSS standard
   • BThreat modeling replaces the need for SAST and DAST
   • CThreat modeling is only useful for large enterprise applications
   • DThreat modeling identifies design-level issues that automated tools cannot detect
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A DevSecOps team is threat modeling a new application that processes sensitive customer data. They have identified several threats and are now deciding which mitigations to implement. The team has limited budget and time. What is the best way to decide which mitigations to implement?

   • AImplement mitigations that are easiest to implement first.
   • BDefer all mitigations until after launch.
   • CImplement all possible mitigations to ensure maximum security.
   • DPrioritize mitigations based on the risk score of each threat.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A DevSecOps team is comparing STRIDE and PASTA for a new application. They need a methodology that will help them identify threats early in the design phase and also provide a structured way to prioritize them. Which methodology should they choose?

   • ADREAD, because it is a scoring system that can be used with any methodology
   • BPASTA, because it includes both threat identification and risk-based prioritization
   • CCVSS, because it is widely used and provides a standard score
   • DSTRIDE, because it provides a comprehensive list of threat categories
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A DevSecOps team is integrating threat modeling into their CI/CD pipeline. They want to ensure that threat models are updated when code changes. Which approach is most effective?

   • ARequire developers to update the threat model as part of the pull request for any change that affects the architecture
   • BUse an automated tool to regenerate the threat model from the codebase after every merge
   • CUpdate the threat model only when a new vulnerability is discovered in production
   • DRun a full threat modeling session at the end of each sprint
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a primary objective of threat modeling?

   • ATo provide a detailed cost estimate for the software project
   • BTo replace the need for security testing and code reviews
   • CTo guarantee that no security vulnerabilities exist in the final product
   • DTo identify potential security risks and inform security decisions
   Reveal Solution Discussion Select an answer first