A DevSecOps team wants to ensure that threat modeling is not a one-time activity but is integrated into their CI/CD pipeline. They have a large codebase with frequent changes. Which approach best supports continuous threat modeling?

Schedule a full threat modeling workshop every quarter.

Require developers to manually update a threat model spreadsheet before each release.

Automatically generate threat models from infrastructure-as-code and application code changes, and trigger reviews for high-risk changes.

Perform threat modeling only when a new feature is requested.

Which practice best exemplifies the integration of threat modeling into a DevSecOps pipeline?

Outsourcing threat modeling to an external consultant once a year

Including threat modeling as a mandatory step in the design review for each new feature

Running threat modeling only when a security incident occurs

Using threat modeling solely to satisfy compliance requirements before release

EC-CouncilCertified DevSecOps Engineer

Domain 2Objective 1

Threat Modeling Concepts ECDE Practice Questions (Page 4)

Part of the Plan Stage: Threat Modeling and Pre-Commit Security domain, which makes up ~19% of our current practice bank.

35questions here

7free pages

5concepts

Questions 16–20

16application · medium
A DevSecOps team wants to ensure that threat modeling is not a one-time activity but is integrated into their CI/CD pipeline. They have a large codebase with frequent changes. Which approach best supports continuous threat modeling?
Select an answer first
17foundation · easy
Which threat modeling methodology uses a risk-rating system that evaluates Damage, Reproducibility, Exploitability, Affected Users, and Discoverability?
Select an answer first
18application · medium
A DevSecOps team is adopting threat modeling for a new microservices-based payment system. The team wants a methodology that emphasizes business logic attacks, data flow analysis, and produces a risk score to prioritize fixes. The team also needs to integrate this into their CI/CD pipeline so that threat models are updated as the architecture evolves. Which methodology best fits these requirements?
Select an answer first
19foundation · easy
Which practice best exemplifies the integration of threat modeling into a DevSecOps pipeline?
Select an answer first
20expert · hard
A security analyst is using DREAD to score a threat. They have assigned the following ratings: Damage = 8, Reproducibility = 9, Exploitability = 7, Affected users = 6, Discoverability = 5. What is the overall DREAD score?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.

Threat Modeling Concepts ECDE Practice Questions (Page 4)

Questions 16–20

A DevSecOps team wants to ensure that threat modeling is not a one-time activity but is integrated into their CI/CD pipeline. They have a large codebase with frequent changes. Which approach best supports continuous threat modeling?

Which threat modeling methodology uses a risk-rating system that evaluates Damage, Reproducibility, Exploitability, Affected Users, and Discoverability?

Which practice best exemplifies the integration of threat modeling into a DevSecOps pipeline?

A security analyst is using DREAD to score a threat. They have assigned the following ratings: Damage = 8, Reproducibility = 9, Exploitability = 7, Affected users = 6, Discoverability = 5. What is the overall DREAD score?

Keep studying — Plan Stage: Threat Modeling and Pre-Commit Security