CDP Threat Modeling & Vulnerability Management

Question 1

What is the primary purpose of threat modeling in a DevSecOps pipeline?

Accepted Answer

To identify potential security threats and vulnerabilities early in the development process

Answer

To automatically patch all discovered vulnerabilities in production systems

Answer

To replace penetration testing in the software development lifecycle

Answer

To generate compliance reports for regulatory audits

Question 2

Which threat modeling framework categorizes threats using the STRIDE mnemonic?

Accepted Answer

Microsoft STRIDE

Answer

PASTA (Process for Attack Simulation and Threat Analysis)

Answer

VAST (Visual, Agile, and Simple Threat modeling)

Answer

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)

Question 3

In the STRIDE threat model, what does the letter 'T' represent?

Accepted Answer

Tampering

Answer

Traceability

Answer

Transparency

Answer

Tracking

Question 4

What does the DREAD risk assessment model use to calculate risk scores?

Accepted Answer

Damage Potential, Reproducibility, Exploitability, Affected Users, Discoverability

Answer

Detection, Response, Evasion, Assessment, Defense

Answer

Data Loss, Risk Level, Exposure Window, Audit Trail, Defense Cost

Answer

Damage Scope, Remediation Time, Ease of Exploit, Asset Value, Detection Rate

Question 5

Which threat modeling approach uses hierarchical tree structures to visually represent how an attacker might achieve a malicious goal?

Accepted Answer

Attack Tree Analysis

Answer

STRIDE methodology

Answer

PASTA methodology

Answer

LINDDUN methodology

Question 6

What is the primary output of the PASTA (Process for Attack Simulation and Threat Analysis) threat modeling methodology?

Accepted Answer

A prioritized list of threats aligned with business impact and risk

Answer

A list of security controls to implement in the codebase

Answer

An automated vulnerability scan report of the production environment

Answer

A penetration testing roadmap for the security team

Question 7

In threat modeling data flow diagrams, what is a 'trust boundary'?

Accepted Answer

A point where data passes between components with different security trust levels

Answer

A firewall rule separating internal and external network segments

Answer

An SSL/TLS certificate validation checkpoint in an API gateway

Answer

A user authentication requirement enforced at the application layer