Perform Threat Modeling CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security architect is using PASTA to threat model a new online banking application. During the attack simulation stage, the architect wants to model the most likely attack path an adversary would take to compromise a user's account. The architect has identified several potential entry points, including the login page, the password reset flow, and the mobile app API. Which approach best aligns with PASTA's principles for this stage?

   • AList all possible vulnerabilities in each entry point and assign CVSS scores to each one.
   • BCreate attack trees for each entry point and analyze which path is most feasible and impactful for the attacker.
   • CFocus only on the login page because it is the most common entry point for attackers.
   • DAsk the development team which entry point they think is most vulnerable and focus on that.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst has identified two vulnerabilities in a web application. Vulnerability A has a CVSS v3.1 base score of 9.8, and Vulnerability B has a base score of 4.2. The analyst has limited remediation resources and must prioritize which vulnerability to fix first. According to the CVSS scoring system, what should the analyst do?

   • APrioritize Vulnerability B because lower-scored vulnerabilities are often easier to exploit and therefore more dangerous.
   • BPrioritize Vulnerability A because its higher CVSS score indicates a more severe risk that should be addressed first.
   • CTreat both vulnerabilities as equal priority because CVSS scores do not differentiate between vulnerabilities in the same application.
   • DIgnore the CVSS scores and fix the vulnerability that was discovered first, regardless of severity.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   During a threat modeling session, the team identifies a threat where an attacker could modify data in transit between the client and server. Which STRIDE category does this threat belong to?

   • ATampering
   • BInformation Disclosure
   • CRepudiation
   • DSpoofing
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of a credible source for threat intelligence?

   • AAn anonymous forum post
   • BA social media post from an unknown user
   • CA random blog post with no citations
   • DA vendor's security advisory
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of threat intelligence in the context of threat modeling?

   • ATo provide a scoring system for vulnerabilities
   • BTo simulate attacks from an attacker's perspective
   • CTo categorize threats into six types
   • DTo identify relevant and credible threats to the organization
   Reveal Solution Discussion Select an answer first