Threat Modeling and Threat Landscape CRISC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A healthcare organization is conducting a threat modeling exercise for a new patient data exchange platform. The team has identified the system's components, data flows, and trust boundaries. They are now at the stage where they need to systematically identify potential threats to each component and data flow. Which step of the threat modeling process are they performing?

   • ASystem decomposition
   • BDocumentation and reporting
   • CThreat identification
   • DRisk prioritization
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of documenting the results of a threat modeling exercise?

   • ATo replace the need for penetration testing.
   • BTo automatically apply security patches to the system.
   • CTo provide a record of identified threats and mitigations for future reference and continuous improvement.
   • DTo satisfy regulatory requirements for real-time monitoring.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large e-commerce company is redesigning its authentication system. The security team must choose a threat modeling approach. They need to identify threats that could compromise user accounts, and they also need to prioritize which threats to address first based on the potential damage. The team has limited time and wants a methodology that combines both identification and prioritization in a structured way. Which approach is most suitable?

   • AUse attack trees and assign CVSS scores to each node
   • BUse only DREAD and brainstorm threats informally
   • CUse only STRIDE and rely on expert judgment for prioritization
   • DUse STRIDE to identify threats, then apply DREAD to prioritize them
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is reviewing the threat landscape for a financial institution. They notice that a new ransomware group has emerged that specifically targets financial institutions and uses advanced evasion techniques. The analyst needs to update the risk assessment to reflect this new threat. Which action is most appropriate?

   • AIncrease the impact rating for all ransomware scenarios
   • BIncorporate the new threat actor into the threat landscape profile and adjust the likelihood ratings for relevant risk scenarios
   • CWait for the threat to be confirmed by multiple sources before updating the risk assessment
   • DIgnore the new threat because it is not yet in the organization's threat intelligence feeds
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the context of risk assessment, what is the role of threat modeling in risk identification?

   • AIt helps identify potential threats that could exploit vulnerabilities in the system.
   • BIt quantifies the financial impact of each risk.
   • CIt selects the appropriate risk response strategy.
   • DIt determines the risk appetite of the organization.
   Reveal Solution Discussion Select an answer first