Threat Modeling Frameworks (STRIDE, DREAD, PASTA, CVSS) ISE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security analyst is comparing two vulnerabilities in a smart-building system. Vulnerability 1 has a CVSS base score of 9.0, but it only affects 5 devices in a single building. Vulnerability 2 has a CVSS base score of 5.0, but it affects 1,000 devices across multiple buildings. The analyst must decide which vulnerability to remediate first. The organization uses DREAD for prioritization. Which vulnerability should be prioritized, and why?

   • AVulnerability 1, because it has a higher Exploitability score in DREAD
   • BBoth vulnerabilities equally, because CVSS and DREAD scores should be averaged together
   • CVulnerability 1, because its higher CVSS score indicates a more critical vulnerability
   • DVulnerability 2, because its higher Affected Users score in DREAD likely outweighs Vulnerability 1's higher CVSS score
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A smart-building operator needs to identify all possible threat types in its access-control system and then prioritize them for remediation. The team wants a structured way to ensure no threat category is overlooked, followed by a simple numeric prioritization. Which combination of frameworks best achieves this?

   • AUse CVSS to enumerate threats, then PASTA to prioritize them
   • BUse DREAD to enumerate threats, then STRIDE to prioritize them
   • CUse PASTA to enumerate threats, then CVSS to prioritize them
   • DUse STRIDE to enumerate threats, then DREAD to prioritize them
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A smart-home vendor has a limited budget and must fix one of two vulnerabilities. Vulnerability A can be exploited remotely by any unauthenticated user with a known public exploit, and it affects all 100,000 deployed devices, but the impact is limited to a temporary loss of voice-assistant functionality. Vulnerability B requires physical access to a device and a custom exploit, and it affects only 100 devices, but it can permanently brick the device. Using DREAD, which vulnerability should the vendor prioritize?

   • AVulnerability B, because physical access threats are always more severe than remote threats
   • BVulnerability A, because it has a higher Discoverability score than Vulnerability B
   • CVulnerability A, because its high Reproducibility, Exploitability, and Affected Users scores outweigh Vulnerability B's higher Damage score
   • DVulnerability B, because permanent bricking is more damaging than temporary loss of functionality
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   A security team needs to choose a threat modeling approach for an IoT system where the primary goal is to prioritize vulnerabilities based on a standardized, industry-recognized severity score that can be compared across different products. Which framework is most appropriate?

   • APASTA
   • BCVSS
   • CSTRIDE
   • DDREAD
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A smart-lock vendor receives a report that a firmware update can be intercepted and replaced during transmission, allowing an attacker to install malicious code. The vendor wants to classify this threat using STRIDE and then quantify its severity with CVSS. Which STRIDE category best fits the threat, and which CVSS metric is most directly affected by the attacker's ability to replace the update?

   • ATampering; Integrity metric
   • BSpoofing; Confidentiality metric
   • CElevation of Privilege; Attack Vector metric
   • DRepudiation; Availability metric
   Reveal Solution Discussion Select an answer first