Threat Modeling Frameworks KCSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of threat modeling in a cloud-native environment?

   • ATo replace the need for penetration testing by providing a complete list of all possible exploits.
   • BTo automate the deployment of security patches across all cloud-native components.
   • CTo ensure compliance with regulatory standards by generating audit reports automatically.
   • DTo identify, quantify, and address security risks by systematically analyzing the system's design and architecture.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which technique is commonly used in threat modeling to visually represent the flow of data through a system and identify trust boundaries?

   • AEntity-relationship diagrams
   • BNetwork topology maps
   • CData flow diagrams (DFDs)
   • DGantt charts
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When threat modeling a cloud-native architecture, which component is specifically introduced by the use of microservices and requires careful consideration of trust boundaries?

   • AHypervisor
   • BService-to-service communication
   • CPhysical network switches
   • DOperating system kernel
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A DevSecOps team is integrating threat modeling into their CI/CD pipeline. They have a large microservices architecture with frequent deployments. They want to automate threat identification but are concerned about alert fatigue and false positives. Which approach best balances automation with human oversight?

   • ADisable automated threat modeling and rely on manual reviews before each release
   • BRun automated threat modeling tools in a report-only mode and review results in a weekly security meeting
   • CAutomatically apply mitigations suggested by the tool without human review
   • DBlock deployments whenever the automated tool identifies any potential threat
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the threat modeling process, what is the primary goal of the 'system decomposition' step?

   • ATo implement security controls for each component.
   • BTo test the system for vulnerabilities.
   • CTo break the system into smaller components and understand its data flows and trust boundaries.
   • DTo assign a risk score to each identified threat.
   Reveal Solution Discussion Select an answer first