Perform Threat Modeling CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following best describes the 'persistence' aspect of an Advanced Persistent Threat (APT)?

   • AThe attacker quickly exfiltrates data and leaves
   • BThe attacker maintains access to the target system over an extended period
   • CThe attacker uses multiple types of malware
   • DThe attacker uses only zero-day exploits
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A system administrator notices that a developer has been accessing the production database during off-hours and downloading large amounts of customer data. The developer has legitimate access to the database for their job. Upon investigation, the administrator finds that the developer has been selling the data to a competitor. Which type of insider threat does this represent?

   • ACompromised insider
   • BThird-party supplier risk
   • CNegligent insider
   • DMalicious insider
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An employee's credentials are stolen and used by an external attacker to access sensitive data. How is this insider threat classified?

   • ANegligent insider
   • BCompromised insider
   • CUnintentional insider
   • DMalicious insider
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A small startup with a single security engineer is adopting threat modeling for the first time. The engineer finds STRIDE too granular for their small team and PASTA too heavy. They want a simple, visual approach that helps them identify threats quickly without extensive documentation. Which hybrid approach would be most suitable?

   • AUse only CVSS scores to prioritize vulnerabilities without any structured threat identification.
   • BAdopt the full PASTA methodology and complete all seven stages for every feature.
   • CSkip threat modeling and rely on penetration testing after each release.
   • DUse a lightweight data flow diagram and apply STRIDE categories as a checklist to identify threats, documenting only the high-risk ones.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A large enterprise has a mature security team that has used STRIDE for years. They are now adopting PASTA because leadership wants a more business-focused approach. The team finds PASTA's full process too heavy for their weekly sprint-based development cycles. They want to keep the business-impact alignment of PASTA but retain the lightweight, developer-friendly categorization of STRIDE for quick assessments. What is the most appropriate approach?

   • ACreate a hybrid methodology that uses PASTA's business-impact analysis for major features and STRIDE for rapid, iterative threat identification in sprints.
   • BAbandon STRIDE entirely and use PASTA for all features, even if it slows down the sprint cycle.
   • CUse PASTA only for the initial architecture and never revisit it, relying on code reviews for all future threats.
   • DUse STRIDE for everything and present the results to leadership as business impact analysis.
   Reveal Solution Discussion Select an answer first