Threat Modeling Frameworks (STRIDE, DREAD, PASTA, CVSS) ISE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is prioritizing vulnerabilities for a fleet of IoT devices. They have CVSS scores for each vulnerability, but management wants a more business-focused prioritization. The team decides to use DREAD, but they are concerned about the subjectivity of DREAD scores. What is the best way to address this concern while still using DREAD?

   • AUse DREAD scores as the sole basis for prioritization.
   • BDefine clear rating criteria for each DREAD component and have multiple reviewers score independently.
   • CUse only CVSS scores and ignore DREAD.
   • DReplace DREAD with a single CVSS score for each vulnerability.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A smart-city project is deploying connected traffic lights. The security team needs to ensure that threat modeling aligns with the city's business objective of maintaining traffic flow and public safety. They want to simulate realistic attack scenarios against the traffic light control system and involve business stakeholders in the process. Which threat modeling methodology best fits this requirement?

   • APASTA
   • BCVSS
   • CDREAD
   • DSTRIDE
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A wearable-device manufacturer wants to adopt a threat modeling approach that is lightweight, does not require extensive business analysis, and helps the team quickly categorize threats during design reviews. They also want to ensure they cover all major threat types. Which framework is the best fit?

   • ASTRIDE, because it provides a simple categorization of six threat types that can be applied during design reviews
   • BPASTA, because it is a comprehensive methodology that includes business alignment
   • CDREAD, because it provides a numeric score for each threat
   • DCVSS, because it is the industry standard for vulnerability scoring
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is comparing two vulnerabilities in IoT devices. Vulnerability A has a CVSS base score of 7.5, and Vulnerability B has a CVSS base score of 6.5. However, the DREAD assessment shows that Vulnerability B has higher Damage and Affected Users scores. How should the analyst prioritize these vulnerabilities?

   • ATreat both vulnerabilities as equal priority.
   • BPrioritize Vulnerability A because it has a higher CVSS score.
   • CPrioritize Vulnerability A because CVSS is the industry standard.
   • DPrioritize Vulnerability B because DREAD reflects higher business impact.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A large enterprise is deploying IoT devices across multiple regions. They need to choose a threat modeling approach that can scale across teams and align with global business objectives. They also need to produce consistent, repeatable results. Which approach is most suitable?

   • AUse CVSS scores only for prioritization.
   • BUse DREAD scores without a standardized process.
   • CUse STRIDE informally in each team.
   • DAdopt PASTA as a standard methodology with defined stages and deliverables.
   Reveal Solution Discussion Select an answer first