Threat Modeling ISE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A smart doorbell manufacturer is threat modeling its product. The team uses STRIDE and identifies a threat where an attacker can view the video feed without authentication. Which STRIDE category does this threat belong to, and what is the most appropriate next step?

   • ATampering; the next step is to add integrity checks to the video stream.
   • BDenial of Service; the next step is to add redundancy to the video server.
   • CSpoofing; the next step is to implement stronger authentication for the video feed.
   • DInformation Disclosure; the next step is to assess the impact and likelihood of the threat.
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A startup is developing a new IoT device for home automation. The team is new to security and wants to understand why threat modeling is important before they begin development. Which statement best explains the purpose of threat modeling in this context?

   • AIt guarantees that the device will be immune to all cyberattacks.
   • BIt helps identify and prioritize potential security threats early, allowing the team to design mitigations before the product is built.
   • CIt is only required for regulatory compliance and adds no technical value.
   • DIt is a one-time activity performed after the product is released.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of an IoT asset that should be identified during asset identification?

   • AThe firmware version running on a smart thermostat
   • BThe device's user manual
   • CThe brand name of the device manufacturer
   • DThe color of the device casing
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A wearable fitness tracker manufacturer is threat modeling its product. The tracker syncs with a smartphone app via BLE and uploads data to the cloud. The team is identifying threats specific to the IoT ecosystem. Which threat is most directly related to the physical nature of the wearable device?

   • AAn attacker compromises the cloud backend and steals all user data.
   • BAn attacker performs a denial-of-service attack on the smartphone app, preventing it from syncing.
   • CAn attacker intercepts the BLE communication between the tracker and the smartphone app.
   • DAn attacker physically steals the device and extracts the user's personal data from its flash memory.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security consultant is threat modeling a smart home hub that controls lights, locks, and cameras. The client wants to understand which threats are most critical to address given limited resources. The consultant decides to use DREAD after identifying threats. What is the primary purpose of using DREAD in this context?

   • ATo create a visual diagram of attack paths from the hub to each device.
   • BTo categorize threats into spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
   • CTo assign numerical scores to threats based on damage, reproducibility, exploitability, affected users, and discoverability.
   • DTo identify all entry points and trust boundaries in the smart home architecture.
   Reveal Solution Discussion Select an answer first