Threat Modeling Frameworks KCSA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is evaluating threat modeling methodologies for a legacy monolithic application that is being migrated to Kubernetes. They need a methodology that focuses on business impact and risk, and that involves stakeholders from business, development, and security. Which methodology aligns best with this requirement?

   • APASTA
   • BSTRIDE
   • CDREAD
   • DAttack trees
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is migrating a monolithic application to a microservices architecture on Kubernetes. The security team wants to perform threat modeling to identify risks introduced by the new architecture. They have limited time and need to focus on the most critical areas. Which approach is most effective?

   • AReuse the threat model from the monolithic application without changes
   • BFocus threat modeling on the new trust boundaries and data flows introduced by microservices
   • CConduct a full PASTA analysis for every microservice
   • DPerform threat modeling only on the container images
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security architect is leading a threat modeling session for a new microservices-based payment platform. The team needs to identify threats across all components, including the API gateway, individual services, and the message queue. They want a structured approach that systematically examines each component from multiple perspectives, such as spoofing, tampering, and repudiation. Which methodology should they use?

   • ASTRIDE
   • BDREAD
   • CAttack trees
   • DPASTA
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security architect is threat modeling a multi-tenant SaaS platform built on Kubernetes. Each tenant's data is isolated using namespaces and network policies. The team has identified a threat of cross-tenant data access via a compromised pod. They need to prioritize this threat against other identified threats. Which factor should be most heavily weighted in the prioritization?

   • AThe cost of implementing mitigations
   • BThe likelihood of the threat being exploited
   • CThe number of tenants affected
   • DThe impact on tenant data confidentiality
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security engineer is using an automated threat modeling tool that integrates with their CI/CD pipeline. The tool generates a data flow diagram from the application's code and infrastructure definitions. What is the primary benefit of using such a tool in this context?

   • AIt automatically fixes all identified vulnerabilities
   • BIt provides a final security audit report for compliance
   • CIt eliminates the need for manual threat modeling entirely
   • DIt enables continuous threat identification as the application evolves
   Reveal Solution Discussion Select an answer first