1.10 - Understand and Apply Threat Modeling Concepts and Methodologies CISSP Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A security team is comparing threat modeling methodologies. They need a methodology that is particularly effective for analyzing a single, high-value target, such as a critical database server, by breaking down the various ways an attacker could compromise it. Which methodology is best suited for this?

   • ADREAD
   • BSTRIDE
   • CAttack trees
   • DPASTA
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is threat modeling a new IoT device that collects health data from patients and transmits it to a cloud backend. The team has limited time and budget. They need to identify the most critical threats quickly and focus mitigation efforts on the highest-risk areas. Which approach is most efficient?

   • ACreate a detailed attack tree for every possible attack path
   • BUse STRIDE to categorize threats and then prioritize using DREAD
   • CConduct a full PASTA analysis
   • DSkip threat modeling and rely on penetration testing after deployment
   Reveal Solution Discussion Select an answer first
3. 23expert · hard

   A security team is threat modeling a new customer-facing web application. They have identified that the application stores sensitive customer data and is accessible over the internet. They have enumerated several threats, including SQL injection, cross-site scripting (XSS), and session hijacking. The team has limited budget and must prioritize which threats to mitigate first. Which threat should be given the highest priority?

   • ASession hijacking, because it allows an attacker to impersonate any user
   • BSQL injection, because it could lead to unauthorized access to the entire database
   • CXSS, because it affects all users of the application
   • DAll threats should be mitigated simultaneously
   Reveal Solution Discussion Select an answer first