1.02 Analyze Threat Modeling Data to Determine Risk Profiles of the Infrastructure and Applications 401 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is correlating threat intelligence feeds with network telemetry to profile the risk of a critical application server. The threat intelligence feed reports a new zero-day vulnerability in the server's operating system. The network telemetry shows no unusual traffic to or from the server. The server is internet-facing and contains sensitive data. What is the most accurate risk assessment?

   • AHigh risk because the server is internet-facing and the vulnerability is zero-day
   • BMedium risk because the server is internet-facing but no exploitation has been observed
   • CNo risk because the vulnerability is not yet exploited
   • DLow risk because there is no unusual traffic indicating exploitation
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which risk should be prioritized first when using a likelihood-impact approach?

   • AHigh likelihood and high impact
   • BLow likelihood and high impact
   • CLow likelihood and low impact
   • DHigh likelihood and low impact
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which application security factor is most directly related to the risk of injection attacks?

   • ASession management
   • BAuthentication mechanism
   • CData encryption at rest
   • DInput validation
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is compiling threat modeling data for a data center. They have vulnerability scan results showing a critical unpatched vulnerability in a database server. They also have threat intelligence indicating that this vulnerability is being actively exploited in the wild. Which additional data source would best help determine the likelihood of this server being attacked?

   • AThe server's hardware specifications
   • BA list of all software installed on the server
   • CThe organization's security policies
   • DNetwork telemetry showing whether the database server is reachable from the internet
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An e-commerce company is profiling the risk of its customer-facing application. The application has a vulnerability in its authentication mechanism that allows brute-force attacks, and it stores customer credit card data. Threat intelligence shows an increasing number of credential-stuffing attacks against similar platforms. The company has a limited security budget and must prioritize fixes. Which risk should be addressed first?

   • AA low-severity input validation issue in a public-facing form that does not store sensitive data
   • BThe authentication vulnerability, because it is directly targeted by the active threat and exposes sensitive data
   • CA high-severity vulnerability in a legacy system that is scheduled for decommissioning next month
   • DA moderate-severity issue in an internal admin tool that is not exposed to the internet
   Reveal Solution Discussion Select an answer first