Threat Modeling and Threat Landscape CRISC Practice Questions (Page 6)

Questions 26–28

1. 26foundation · easy

   What is the primary purpose of threat modeling in the context of information systems risk assessment?

   • ATo document the system's compliance with regulatory requirements.
   • BTo automatically remediate vulnerabilities without human intervention.
   • CTo provide a real-time alerting mechanism for ongoing security incidents.
   • DTo identify and prioritize potential threats to the system so that mitigation efforts can be focused on the most significant risks.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A startup is developing a new IoT device that collects health data. The team is new to security and wants to understand the potential threats to their device before launch. They have limited budget and need a cost-effective way to get started. Which action is most aligned with the purpose of threat modeling?

   • AConduct a simple threat modeling workshop with the development team
   • BWait for a security breach to learn about threats
   • CHire an external consultant to do everything
   • DPurchase an expensive threat intelligence platform
   Reveal Solution Discussion Select an answer first
3. 28foundation · easy

   How can vulnerability databases, such as the National Vulnerability Database (NVD), be used in risk assessment?

   • ATo provide real-time alerts for ongoing attacks.
   • BTo automatically patch all identified vulnerabilities.
   • CTo replace the need for penetration testing.
   • DTo identify known vulnerabilities in software and hardware that may affect the organization's systems.
   Reveal Solution Discussion Select an answer first