Threat Modeling Frameworks (STRIDE, DREAD, PASTA, CVSS) ISE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is evaluating a vulnerability in an IoT device's firmware that allows remote code execution without authentication. The analyst needs to communicate the severity to management. Which approach best combines CVSS and DREAD to support the communication?

   • AUse the CVSS base score to convey severity and DREAD scores to explain business impact.
   • BUse only DREAD because it is easier for management to understand.
   • CReplace CVSS with DREAD to avoid confusion.
   • DUse only CVSS because it is the industry standard.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An IoT security team identifies two threats to a fleet of medical wearables: Threat X requires physical access to each device and a rare exploit, but if successful it can alter patient dosage data. Threat Y can be triggered remotely by any unauthenticated user with a simple script, but it only causes a temporary loss of telemetry. Using DREAD, which threat should be prioritized as higher risk, and why?

   • AThreat X, because Damage is the most heavily weighted DREAD factor
   • BThreat Y, because it has a higher Discoverability score than Threat X
   • CThreat Y, because its high Reproducibility, Exploitability, and Affected Users scores outweigh Threat X's higher Damage score
   • DThreat X, because physical access threats are always more severe than remote threats
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A medical IoT device transmits patient vitals to a cloud dashboard. A security analyst discovers that an attacker can replay captured messages to inject false readings, and that the device does not log who sent the data. The analyst wants to classify these issues using STRIDE and then assess their severity with CVSS. Which STRIDE categories apply, and which CVSS metric is most relevant to the lack of logging?

   • ADenial of Service and Elevation of Privilege; Availability metric
   • BSpoofing and Information Disclosure; Confidentiality metric
   • CTampering and Repudiation; Integrity metric
   • DTampering and Spoofing; Availability metric
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security analyst is calculating a CVSS v3.1 base score for a vulnerability in an IoT device. Which metric group is used to compute the base score?

   • ATemporal and Environmental metrics
   • BConfidentiality, Integrity, and Availability only
   • CExploitability and Impact metrics
   • DAttack Vector and Attack Complexity only
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A smart-city project is deploying connected traffic lights. The team wants to use PASTA to model threats. In the first stage, they define business objectives such as minimizing traffic accidents and ensuring emergency vehicles get priority. In a later stage, they decompose the application to identify entry points and trust boundaries. Which PASTA stage comes immediately after application decomposition and before attack analysis?

   • AAttack modeling
   • BBusiness impact analysis
   • CRisk analysis
   • DThreat analysis
   Reveal Solution Discussion Select an answer first