Threat Modeling Frameworks (STRIDE, DREAD, PASTA, CVSS) ISE Practice Questions (Page 9)

Questions 41–42

1. 41expert · hard

   A security consultant is helping a client choose a threat modeling framework for a new IoT product. The client has a small team, limited time, and needs to quickly identify threats and prioritize them. They do not need to align with business objectives or simulate attacks. Which framework should the consultant recommend?

   • APASTA
   • BSTRIDE combined with DREAD
   • CCVSS
   • DSTRIDE alone
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security analyst is assessing a vulnerability in a smart-lock device. The CVSS vector is AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H. The device is installed in a building where only employees have physical access to the network. The analyst must decide whether to treat this as a high-priority risk. Which interpretation is most accurate?

   • AThe vulnerability is not exploitable because it requires user interaction, so it can be ignored.
   • BThe vulnerability has high impact on all three security goals, so it is automatically critical regardless of the attack vector or complexity.
   • CThe vulnerability requires adjacent network access, high attack complexity, high privileges, and user interaction, so it is less likely to be exploited in this environment and may not warrant immediate high-priority action.
   • DThe vulnerability is remotely exploitable over the internet and requires no privileges, so it is critical and must be patched immediately.
   Reveal Solution Discussion Select an answer first