Perform Threat Modeling CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a common method to reduce the attack surface of a system?

   • AIncreasing the number of user accounts
   • BEnabling all available network protocols
   • CAdding more third-party components
   • DDisabling unnecessary services and ports
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which type of insider threat is characterized by an employee who unintentionally causes a security incident due to carelessness or lack of awareness?

   • ANegligent insider
   • BCompromised insider
   • CMalicious insider
   • DThird-party insider
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A team is threat modeling a new REST API that allows clients to query customer records. The API uses API keys for authentication. The team is concerned about a threat where an attacker who obtains a valid API key could impersonate a legitimate client and access sensitive customer data. Which STRIDE category does this threat belong to?

   • ASpoofing
   • BTampering
   • CRepudiation
   • DInformation Disclosure
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is triaging a list of vulnerabilities found in a recent scan. Vulnerability X has a CVSS v3.1 base score of 7.5, and Vulnerability Y has a base score of 6.5. Both vulnerabilities are in the same application and have the same exploitability. The team has time to fix only one vulnerability this sprint. Based on CVSS scores alone, which vulnerability should the team fix first?

   • ANeither, because CVSS scores do not account for the application's business context.
   • BVulnerability X, because its higher CVSS base score indicates a higher severity.
   • CVulnerability Y, because lower scores often indicate more easily exploitable vulnerabilities.
   • DEither vulnerability, because the scores are too close to make a meaningful distinction.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security analyst is investigating a series of anomalies in a corporate network. Over the past year, there have been multiple small data exfiltration events, each involving a different department. The attacker has used a variety of tools, including custom malware and legitimate system administration tools. The attacker has also maintained persistence by creating multiple backdoors. Which set of characteristics most strongly indicates an Advanced Persistent Threat (APT) rather than a series of unrelated attacks?

   • AThe use of custom malware, which is the single defining trait of an APT.
   • BThe use of legitimate system administration tools, which is a sign of an insider threat.
   • CThe long duration, use of diverse tools, and establishment of multiple backdoors for persistence.
   • DThe fact that multiple departments were affected, indicating a wide-spread attack.
   Reveal Solution Discussion Select an answer first