During a threat modeling exercise, a team identifies several threats with different severity levels. They need to decide which threats to address first, considering limited resources. Which step of the threat modeling process should they perform?

Prioritize the threats based on risk (likelihood and impact)

Validate the threats with the development team

Identify mitigations for each threat

A cloud-native team is creating a data flow diagram (DFD) for a new application that uses Kubernetes, with multiple microservices and an ingress controller. They want to ensure the DFD accurately represents the system for threat modeling. What should they include in the DFD?

Only the Kubernetes objects and their configurations

Only the network connections and IP addresses

All components, trust boundaries, and data flows between them

Only the external entities and data stores

In the context of threat modeling, what does 'quantifying' a security risk typically involve?

Measuring the performance impact of security controls on the system.

Assigning a numerical value to the likelihood and impact of a threat to prioritize it against other risks.

Calculating the exact cost of a potential data breach in monetary terms.

Counting the number of vulnerabilities found in the source code repository.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 5Objective 2

Threat Modeling Frameworks KCSA Practice Questions (Page 6)

Part of the Compliance and Security Frameworks domain, which accounts for 10% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

10%of the exam

Questions 26–29

26foundation · easy
Which cloud-native component introduces a unique threat modeling consideration due to its ephemeral and event-driven nature?
Select an answer first
27application · medium
During a threat modeling exercise, a team identifies several threats with different severity levels. They need to decide which threats to address first, considering limited resources. Which step of the threat modeling process should they perform?
Select an answer first
28application · medium
A cloud-native team is creating a data flow diagram (DFD) for a new application that uses Kubernetes, with multiple microservices and an ingress controller. They want to ensure the DFD accurately represents the system for threat modeling. What should they include in the DFD?
Select an answer first
29foundation · easy
In the context of threat modeling, what does 'quantifying' a security risk typically involve?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Threat Modeling Frameworks KCSA Practice Questions (Page 6)

Questions 26–29

Which cloud-native component introduces a unique threat modeling consideration due to its ephemeral and event-driven nature?

During a threat modeling exercise, a team identifies several threats with different severity levels. They need to decide which threats to address first, considering limited resources. Which step of the threat modeling process should they perform?

A cloud-native team is creating a data flow diagram (DFD) for a new application that uses Kubernetes, with multiple microservices and an ingress controller. They want to ensure the DFD accurately represents the system for threat modeling. What should they include in the DFD?

In the context of threat modeling, what does 'quantifying' a security risk typically involve?

Keep studying — Compliance and Security Frameworks