CDP Threat Modeling & Vulnerability Management

Question 1

What is the primary purpose of threat modeling in a DevSecOps pipeline?

Accepted Answer

To identify potential security threats and vulnerabilities early in the development process

Answer

Threat modeling proactively identifies potential threats and vulnerabilities during design, enabling teams to address them before code is written or deployed.

Question 2

Which threat modeling framework categorizes threats using the STRIDE mnemonic?

Accepted Answer

Microsoft STRIDE

Answer

STRIDE was developed by Microsoft and categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Question 3

In the STRIDE threat model, what does the letter 'T' represent?

Accepted Answer

Tampering

Answer

In STRIDE, 'T' stands for Tampering, which refers to unauthorized modification of data in transit or at rest.

Question 4

What does the DREAD risk assessment model use to calculate risk scores?

Accepted Answer

Damage Potential, Reproducibility, Exploitability, Affected Users, Discoverability

Answer

DREAD scores risks across Damage Potential, Reproducibility, Exploitability, Affected Users, and Discoverability to produce a quantified threat severity rating.

Question 5

Which threat modeling approach uses hierarchical tree structures to visually represent how an attacker might achieve a malicious goal?

Accepted Answer

Attack Tree Analysis

Answer

Attack Tree Analysis models threats as a tree where the root node represents an attacker's goal and branches represent different paths to achieve that goal.

(CDP) Certified DevSecOps Professional Practice Test

(CDP) Certified DevSecOps Professional Practice Test

CDP Threat Modeling & Vulnerability Management