Threat Modeling ISE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a systematic method for identifying threats in an IoT system?

   • AWaiting for a security breach to occur
   • BCopying threat lists from other unrelated systems
   • CRelying solely on the security team's intuition
   • DBrainstorming sessions with the development team
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A smart thermostat manufacturer identified a threat where an attacker can remotely control the thermostat by exploiting a vulnerability in the mobile app's API. The risk score is high. The team is considering two mitigations: (1) implement rate limiting on the API, and (2) require multi-factor authentication (MFA) for the mobile app. The product manager wants to minimize user friction. Which mitigation should be recommended?

   • AImplement rate limiting, because it reduces the likelihood of automated attacks without adding user friction.
   • BImplement both rate limiting and MFA, because defense in depth is always the best approach.
   • CDo neither, because the threat is not realistic and the risk score is inflated.
   • DRequire MFA, because it directly addresses the authentication weakness and is more effective than rate limiting.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large organization is adopting IoT devices across multiple departments. The security team wants to implement a consistent threat modeling process. They have limited staff and need to ensure that findings are shared and acted upon. Which approach best balances thoroughness and efficiency?

   • AOutsource threat modeling to an external consultant and have them present findings only to senior management.
   • BUse a standardized threat modeling template and conduct workshops with each department, documenting findings in a shared repository.
   • CHave each department independently choose their own threat modeling methodology and document findings in their own format.
   • DUse a single automated tool that generates a threat model without human input.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security consultant is threat modeling a smart agriculture system with soil sensors, irrigation controllers, and a central management platform. The sensors communicate via LoRaWAN, and the controllers are connected to the internet. The client is concerned about both cyberattacks and physical attacks. Which threat should be considered the highest risk due to its potential to cause widespread damage?

   • AAn attacker jams the LoRaWAN network, temporarily disrupting data collection.
   • BAn attacker physically damages a soil sensor, causing inaccurate readings for one field.
   • CAn attacker intercepts LoRaWAN messages to read soil moisture data.
   • DAn attacker exploits a vulnerability in the irrigation controller's web interface to turn on all irrigation systems simultaneously, causing water damage.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In an IoT system, which of the following is considered a communication channel asset?

   • AThe MQTT broker that relays messages between devices
   • BThe device's serial number
   • CThe sensor's battery level
   • DThe user's mobile app interface
   Reveal Solution Discussion Select an answer first