Perform Threat Modeling CSSLP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During a threat modeling session for an e-commerce application, the team identifies a threat where an attacker can tamper with the price of an item in the shopping cart before checkout. The team assesses that the attack requires a man-in-the-middle position on the network, which is difficult to achieve, but if successful, the financial impact is very high. According to threat analysis techniques, how should the team characterize this threat?

   • AHigh likelihood and high impact, requiring immediate remediation before launch.
   • BLow likelihood but high impact, requiring a mitigation that addresses the integrity of the transaction.
   • CLow likelihood and low impact, so it can be accepted without any mitigation.
   • DHigh likelihood but low impact, so a simple code review is sufficient.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is investigating a data breach where sensitive customer records were leaked. The investigation reveals that an employee's credentials were used to access the data from a foreign IP address at 3:00 AM. The employee claims they were asleep and did not authorize the access. Further analysis shows the employee had recently clicked a link in a phishing email. Which type of insider threat does this scenario best represent?

   • AMalicious insider, because the employee is lying about the phishing email to cover their tracks.
   • BNegligent insider, because the employee clicked a phishing link, which is a careless action.
   • CThird-party supplier risk, because the foreign IP address suggests an external vendor was involved.
   • DCompromised insider, because the employee's credentials were stolen and used by an external attacker.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which threat modeling methodology is specifically designed to align threat modeling with business objectives and simulate attacks from an attacker's perspective?

   • AHybrid Threat Modeling
   • BPASTA
   • CCVSS
   • DSTRIDE
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   An organization wants to create a threat modeling process that uses STRIDE for categorization and attack trees for detailed attack path analysis. What is this approach called?

   • ACVSS
   • BSTRIDE
   • CHybrid Threat Modeling
   • DPASTA
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a security risk introduced by third-party suppliers?

   • AIncreased software licensing costs
   • BIncreased network bandwidth usage
   • CReduced employee productivity
   • DDependency on external components that may have vulnerabilities
   Reveal Solution Discussion Select an answer first