Threat Modeling and Threat Landscape CRISC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is conducting a threat modeling exercise for a new web application. They have identified a list of potential threats and now need to rate them based on the damage potential, ease of exploitation, and the number of affected users. Which methodology is designed for this type of prioritization?

   • ASTRIDE
   • BAttack trees
   • CPASTA
   • DDREAD
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is compiling threat intelligence to support a risk assessment for a new cloud-based application. The analyst needs a source that provides up-to-date information on known software vulnerabilities and their severity scores. Which source is most appropriate for this specific need?

   • ADark web monitoring services
   • BIndustry-specific threat reports
   • CCVE database and CVSS scores
   • DInternal incident response logs
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is conducting a threat modeling exercise for a new mobile application that handles sensitive customer data. The team has completed the system decomposition and identified several threats. However, they are struggling to decide which threats to address first because the risk assessment has not yet been completed. The project manager wants to ensure that the most critical threats are mitigated before the app is released. What is the most effective way to prioritize threats in this situation?

   • AAddress all threats equally to avoid missing any
   • BPrioritize based on the ease of mitigation rather than the risk level
   • CWait for the formal risk assessment to be completed before taking any action
   • DUse a qualitative risk rating based on the team's expertise and the threat model findings
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A software development team is about to start coding a new module for an existing application. The project manager wants to ensure that security considerations are integrated early in the development lifecycle. The team has limited time and needs a lightweight approach to identify potential threats without a full-scale risk assessment. Which action best aligns with the purpose of threat modeling in this context?

   • ASkip threat modeling and rely on the security team's annual risk assessment
   • BConduct a brief threat modeling session to identify potential threats and design mitigations
   • CDefer all security analysis until after the module is deployed
   • DRely solely on penetration testing after development
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which statement best describes the role of threat modeling within the overall risk assessment process?

   • AIt is an automated scanning tool that detects vulnerabilities in real time.
   • BIt is primarily a tool for calculating the financial impact of security incidents.
   • CIt is a systematic process that identifies threats and helps prioritize them for further risk analysis.
   • DIt is a one-time activity performed only after a security breach occurs.
   Reveal Solution Discussion Select an answer first