Common Attack Scenarios CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary goal of scenario-based threat modeling?

   • ATo identify and prioritize potential attack paths that an attacker might take
   • BTo replace the need for security testing
   • CTo document all possible software bugs in the system
   • DTo ensure compliance with all relevant regulations
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A threat modeling team is evaluating a new feature in a web application that allows users to upload and share documents. The team has limited resources and can only implement a few mitigations. They identify the following threats: (1) malicious file upload leading to RCE, (2) XSS via document content, (3) unauthorized access to other users' documents, and (4) DoS via large file uploads. The application is used by a small internal team. Which threat should be prioritized for mitigation FIRST?

   • AXSS via document content
   • BMalicious file upload leading to RCE
   • CDoS via large file uploads
   • DUnauthorized access to other users' documents
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security tester is analyzing a phishing email that tricked an employee into entering credentials on a fake login page. The attacker then used those credentials to access the corporate VPN and move laterally to a database server. Which phase of the attack lifecycle is the tester MOST directly observing when the attacker authenticates to the VPN?

   • AWeaponization
   • BInitial Access
   • CExfiltration
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is using scenario-based threat modeling for a new customer-facing web portal. They identify that the portal accepts credit card payments and stores customer PII. Which threat scenario should be prioritized FIRST in their threat model?

   • AAn attacker exfiltrating the customer database via SQL injection
   • BAn attacker performing a denial-of-service attack on the web server
   • CAn attacker defacing the public homepage
   • DAn attacker brute-forcing the administrator's password
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the main value of analyzing real-world attack case studies for a security test engineer?

   • AIt provides concrete examples of how vulnerabilities are exploited in practice.
   • BIt eliminates the need for continuous security monitoring.
   • CIt provides a list of all vulnerabilities that exist in the tester's system.
   • DIt guarantees that the same attack will not succeed against their system.
   Reveal Solution Discussion Select an answer first