Threat Modeling Concepts ECDE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A DevSecOps team is integrating threat modeling into their pipeline. They have a policy that all threats must be mitigated before release. However, this is causing delays because some threats are low risk and the team is spending too much time on them. What is the best adjustment to their policy?

   • AAllow the team to accept low-risk threats with documented justification
   • BRequire all threats to be mitigated, but only for critical services
   • CAutomate the mitigation of all threats
   • DRemove the threat modeling step from the pipeline to avoid delays
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A DevSecOps team is threat modeling a new authentication service. They have identified several threats and now need to decide which ones to address first. What should they use to prioritize?

   • AThe number of lines of code affected.
   • BThe order in which threats were identified.
   • CA risk score based on likelihood and impact.
   • DThe difficulty of implementing a mitigation.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A DevSecOps team wants to integrate threat modeling into their CI/CD pipeline so that every code change is analyzed for new threats before deployment. They have a large existing application and limited security team capacity. What is the most effective approach?

   • APerform a one-time threat model and then rely on automated SAST tools to catch new issues
   • BAutomate threat modeling for changes that affect trust boundaries and data flows, and review results in the security backlog
   • CUse DREAD scoring on every dependency update and deploy only if the score is below a threshold
   • DRun a full STRIDE analysis on every build and block the pipeline if any threat is found
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of threat modeling in the software development lifecycle?

   • ATo ensure that all software code is written in a secure programming language
   • BTo perform penetration testing on a fully deployed application to find exploitable weaknesses
   • CTo identify and prioritize potential security threats and vulnerabilities in a system design before implementation
   • DTo automate the deployment of security patches and updates across the production environment
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A DevSecOps team is about to start a threat modeling exercise for a new customer-facing web application. The product owner asks, 'What will we actually get out of this?' Which answer best describes the primary objectives of threat modeling?

   • AA guarantee that the application will be free from security breaches after deployment.
   • BA prioritized set of security risks and informed decisions about where to invest mitigation efforts.
   • CA compliance certificate that satisfies all regulatory requirements.
   • DA list of all possible vulnerabilities in the codebase with exact CVSS scores.
   Reveal Solution Discussion Select an answer first