1.10 - Understand and Apply Threat Modeling Concepts and Methodologies CISSP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A software development team is conducting a threat modeling exercise for a new customer relationship management (CRM) application. They have identified the data assets, created data flow diagrams, and enumerated potential threats. According to a typical threat modeling process, what should the team do next?

   • APrioritize the threats and develop a mitigation plan
   • BDocument the threats and close the exercise
   • CImplement security controls for all identified threats immediately
   • DRetest the application to confirm the threats are real
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which statement best describes the role of threat modeling in the software development lifecycle?

   • AIt is a one-time activity conducted by the security team without developer involvement
   • BIt is an ongoing process that helps identify and mitigate threats early in the design phase
   • CIt is performed only after a security incident to determine the root cause
   • DIt is a compliance requirement that only applies to government systems
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which threat modeling methodology is specifically designed to analyze threats from an attacker's perspective by focusing on the attacker's goals?

   • AAttack Trees
   • BSTRIDE
   • CPASTA
   • DCVSS
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A team is threat modeling a new online ordering system. They have created a data flow diagram showing that customer order data flows from the web server to the database. They are now identifying threats. Which step of the threat modeling process are they performing?

   • AAsset identification
   • BThreat enumeration
   • CMitigation planning
   • DRisk assessment
   Reveal Solution Discussion Select an answer first
6. 5expert · medium

   A threat modeling team is working on a new payment application. They have identified that the application processes credit card data, and they have created a data flow diagram. During threat enumeration, they identify a threat where an attacker could intercept the credit card data in transit. The team is now deciding on mitigations. Which mitigation is most appropriate for this threat?

   • AEncrypt the data at rest in the database
   • BImplement strong authentication for users
   • CUse a web application firewall (WAF)
   • DEncrypt the data in transit using TLS
   Reveal Solution Discussion Select an answer first