Threat Modeling Frameworks KCSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is adopting a serverless architecture using AWS Lambda for data processing. During threat modeling, the security team wants to identify threats specific to serverless functions, such as event injection and insecure function dependencies. Which approach would best capture these threats?

   • AApply STRIDE to the entire cloud infrastructure
   • BUse a threat library tailored to serverless architectures
   • CConduct a penetration test on the Lambda functions
   • DReview the code for common vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the correct order of the systematic steps in the threat modeling process?

   • AIdentify threats, decompose the system, plan mitigations, prioritize risks.
   • BDecompose the system, identify threats, prioritize risks, plan mitigations.
   • CPlan mitigations, prioritize risks, identify threats, decompose the system.
   • DPrioritize risks, plan mitigations, decompose the system, identify threats.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A startup is building a new cloud-native application and wants to adopt threat modeling early in the development process. The team is small and has limited security expertise. They want to identify potential security risks in their architecture without spending excessive time. What is the most effective initial approach?

   • ADefer threat modeling until after the application is deployed
   • BConduct a full PASTA analysis with all stakeholders
   • CHire an external consultant to perform a one-time threat model
   • DUse a lightweight threat modeling methodology and a threat library to identify common threats
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A software development team wants to integrate threat modeling into their CI/CD pipeline to ensure continuous security assessment. They want to automate the identification of threats whenever a new microservice is added. Which practice best supports this goal?

   • AConduct a threat modeling workshop once per quarter
   • BRequire developers to complete a security checklist before merging code
   • CPerform a manual threat modeling session at the end of each sprint
   • DRun an automated threat modeling tool that generates a DFD from the infrastructure-as-code definitions
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A DevOps team is adopting DevSecOps and wants to incorporate threat modeling into their agile development process. They want to ensure that threat modeling is not a one-time activity but is continuously updated as the application evolves. Which approach best achieves this?

   • AUse a threat modeling tool only during the design phase
   • BPerform threat modeling only when a major security incident occurs
   • CConduct a comprehensive threat modeling session at the start of the project only
   • DIntegrate threat modeling into the definition of done for each user story
   Reveal Solution Discussion Select an answer first