Threat Modeling and Threat Landscape CRISC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A threat modeling exercise for a new online banking application has been completed. The team has identified several potential threats, including SQL injection, session hijacking, and data leakage. The risk management team now needs to incorporate these findings into the organization's risk register. What is the most appropriate next step?

   • AArchive the threat model and move on to the next project
   • BDelete threats that are not currently being exploited
   • CMap each identified threat to a risk scenario and assess its likelihood and impact
   • DImmediately implement controls for all identified threats
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security operations center (SOC) is enhancing its threat intelligence program. The team wants to improve its ability to detect and respond to emerging threats that are specific to their industry. They have access to multiple sources, including open-source threat feeds, industry ISACs, and internal telemetry. The team has limited resources and must choose the most effective combination. Which approach is most balanced and effective?

   • APurchase all available commercial threat feeds
   • BUse only internal telemetry and ignore external sources
   • CSubscribe to an industry ISAC and integrate its feeds with internal telemetry
   • DRely solely on open-source threat feeds
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is the first step in a typical threat modeling exercise?

   • ADocumentation of findings
   • BRisk rating of threats
   • CSystem decomposition
   • DThreat identification
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In which scenario would an attack tree be most appropriately used as a threat modeling technique?

   • AWhen the objective is to automate the identification of vulnerabilities in code.
   • BWhen a structured, graphical representation of various attack paths to a specific goal is needed.
   • CWhen the goal is to categorize threats into six predefined categories.
   • DWhen a quick, qualitative rating of threat severity is required.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why is it important for risk professionals to understand that the threat landscape evolves over time?

   • ABecause the organization's business goals are static.
   • BBecause regulatory requirements never change.
   • CBecause new threats and threat actors emerge, requiring continuous monitoring and reassessment of risks.
   • DBecause threat modeling is a one-time activity that does not need updates.
   Reveal Solution Discussion Select an answer first