Threat Modeling ISE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is an example of a mitigation strategy for a threat involving unencrypted communication between an IoT device and its backend?

   • AChanging the device's color scheme
   • BIncreasing the device's battery capacity
   • CImplementing TLS encryption for all data transmitted between the device and the backend
   • DRemoving the device's antenna
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   After completing a threat model for an industrial IoT system, a security engineer must present findings to a mixed audience of executives, plant managers, and developers. The executives need to understand business risk, plant managers need operational impact, and developers need technical details. What is the best way to communicate the threat model?

   • ACreate a single report with an executive summary, a risk matrix, and detailed technical appendices.
   • BVerbally summarize the top three threats without any written documentation.
   • CSend the full technical threat model document to all stakeholders.
   • DPresent only the risk scores and mitigation recommendations to all stakeholders.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst is threat modeling a fleet of connected vehicles. The team has identified several threats, including unauthorized remote control of vehicle functions, theft of personal data from the infotainment system, and denial of service against the telematics unit. The team needs to categorize these threats to prioritize them. Which categorization approach would best support prioritization?

   • ACategorize threats by the number of lines of code in the affected component.
   • BCategorize each threat by its potential impact on safety, privacy, and availability, then assign likelihood scores.
   • CCategorize threats by the type of vehicle model they affect.
   • DCategorize threats by the cost of the vehicle.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is a common attack vector specific to IoT devices?

   • AExploitation of default or weak credentials on the device's management interface
   • BSQL injection against the device's firmware update server
   • CPhishing emails sent directly to the device's embedded operating system
   • DDenial-of-service attacks that only affect cloud-based IoT platforms
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A smart lighting company is threat modeling its system. The system includes light bulbs that connect to a hub via Zigbee, and the hub connects to the cloud via Wi-Fi. The team is identifying assets. Which item is a communication channel asset?

   • AThe Zigbee radio frequency used to communicate between the bulbs and the hub.
   • BThe mobile app used to control the lights.
   • CThe cloud server that stores user preferences.
   • DThe user's Wi-Fi password.
   Reveal Solution Discussion Select an answer first