Threat Modeling Frameworks (STRIDE, DREAD, PASTA, CVSS) ISE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   During a threat modeling exercise for a smart grid system, the team identifies a threat where an attacker can modify the firmware update process to install malicious code. They also note that the vulnerability has a high CVSS score. Which STRIDE category does this threat primarily represent, and how does the CVSS score help?

   • ASpoofing; CVSS identifies the attack vector.
   • BDenial of Service; CVSS indicates the availability impact.
   • CRepudiation; CVSS measures the likelihood of denial.
   • DTampering; CVSS quantifies the severity of the vulnerability.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard · select all that apply

   A security architect is selecting frameworks for a comprehensive IoT security program. The program needs to: identify threats during design, prioritize risks for remediation, and score specific vulnerabilities for compliance reporting. Which combination of frameworks would fulfill all three needs? Select all that apply.

   • APASTA
   • BSTRIDE
   • CDREAD
   • DCVSS
   Check answers Discussion Select an answer first
4. 13expert · hard

   A smart-transportation company is using PASTA to model threats to its fleet-management system. In the threat analysis stage, the team identifies a spoofing threat where an attacker can impersonate a vehicle's GPS unit. In the attack modeling stage, they simulate an attack that injects false GPS coordinates. In the vulnerability analysis stage, they find that the system does not authenticate GPS data. Which PASTA stage should the team perform next?

   • AResidual risk mitigation, where the team implements countermeasures
   • BBusiness impact analysis, where the team quantifies the financial impact of the attack
   • CAttack simulation, where the team tests the attack in a live environment
   • DRisk analysis, where the team assesses the likelihood and impact of the identified vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A vulnerability scanner reports a flaw in a smart thermostat's web interface. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The security team must decide whether to patch immediately or wait for the next maintenance window. Which interpretation of the CVSS score is most accurate?

   • AThe vulnerability only affects confidentiality, so the impact is limited to data exposure.
   • BThe CVSS score cannot be interpreted without knowing the DREAD rating.
   • CThe vulnerability requires physical access and high privileges, so the risk is low and patching can wait.
   • DThe vulnerability is remotely exploitable without authentication and has high impact on confidentiality, integrity, and availability, so it should be patched urgently.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is reviewing a threat model for a smart-medication dispenser. The model identifies that an attacker can intercept and modify the prescription data sent from the doctor's portal to the dispenser, and that the dispenser does not verify the sender's identity. The analyst classifies the modification as Tampering and the lack of sender verification as Spoofing. How should the analyst interpret the CVSS metrics for a vulnerability that allows this attack?

   • AThe Confidentiality metric is most directly affected because the attacker intercepts the data.
   • BThe Integrity metric is most directly affected because the prescription data is modified, and the Confidentiality metric is not the primary concern.
   • CThe Availability metric is most directly affected because the dispenser may not function correctly.
   • DThe Attack Vector metric is most directly affected because the attacker is on the network.
   Reveal Solution Discussion Select an answer first