An organization is deploying a new customer portal that will store sensitive personal data. Which countermeasure is most appropriate to mitigate the threat of unauthorized data access?

Implementing encryption for data at rest and in transit

Increasing the number of application servers

Disabling logging to reduce data exposure

Using a firewall to block all incoming traffic

Which activity is part of the mitigation planning step in threat modeling?

Assigning a risk rating to each identified threat

Testing the system for vulnerabilities

Selecting countermeasures to reduce or eliminate identified risks

What is the primary purpose of threat modeling in the context of security risk management?

To automate the deployment of security patches across an organization's infrastructure

To provide a legal framework for prosecuting cybercriminals after an attack

To ensure that all software development projects follow a waterfall methodology

To identify, evaluate, and mitigate potential security threats to a system or application

Certified Information Systems Security Professional

Domain 1Objective 10

1.10 - Understand and Apply Threat Modeling Concepts and Methodologies CISSP Practice Questions (Page 4)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

4concepts

16%of the exam

Questions 16–20

16expert · hard
A large enterprise is adopting a threat modeling methodology for its diverse portfolio of applications, ranging from legacy mainframe systems to cloud-native microservices. The security team needs a methodology that can be applied consistently across all applications, provides a structured way to identify threats, and is well-documented for auditors. They also want to involve business stakeholders in the risk assessment. Which methodology is the best fit?
Select an answer first
17foundation · easy
An organization is deploying a new customer portal that will store sensitive personal data. Which countermeasure is most appropriate to mitigate the threat of unauthorized data access?
Select an answer first
18application · easy
A security engineer is threat modeling a web application using STRIDE. The team identifies that an attacker could modify the price of an item in the shopping cart before it is submitted for payment. Which STRIDE category does this threat belong to?
Select an answer first
19foundation · easy
Which activity is part of the mitigation planning step in threat modeling?
Select an answer first
20foundation · easy
What is the primary purpose of threat modeling in the context of security risk management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

1.10 - Understand and Apply Threat Modeling Concepts and Methodologies CISSP Practice Questions (Page 4)

Questions 16–20

An organization is deploying a new customer portal that will store sensitive personal data. Which countermeasure is most appropriate to mitigate the threat of unauthorized data access?

A security engineer is threat modeling a web application using STRIDE. The team identifies that an attacker could modify the price of an item in the shopping cart before it is submitted for payment. Which STRIDE category does this threat belong to?

Which activity is part of the mitigation planning step in threat modeling?

What is the primary purpose of threat modeling in the context of security risk management?

Keep studying — Security and Risk Management