App Security Engineer Threat Modeling — Questions and Answers
Question 1: What is the primary goal of threat modeling?
- To increase software complexity
- To identify and mitigate security risks early (Correct answer)
- To replace penetration testing
- To delay security assessments until post-deployment
Correct answer: To identify and mitigate security risks early
Threat modeling helps identify security risks early in the software development lifecycle to mitigate potential threats before deployment.
Question 2: Which of the following is a widely used threat modeling framework?
- STRIDE (Correct answer)
- ISO 27001
- NIST 800-53
- GDPR
Correct answer: STRIDE
The STRIDE model categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
Question 3: Why is data flow analysis important in threat modeling?
- It helps in UI/UX design
- It identifies vulnerabilities in data transmission and storage (Correct answer)
- It replaces security controls
- It ensures faster software performance
Correct answer: It identifies vulnerabilities in data transmission and storage
Analyzing data flow helps identify potential security vulnerabilities at various points where data is transmitted, processed, or stored.
Question 4: Which threat category in STRIDE involves unauthorized data modification?
- Spoofing
- Tampering (Correct answer)
- Denial of Service
- Information Disclosure
Correct answer: Tampering
Tampering occurs when an attacker modifies data to alter its integrity, leading to compromised security.
Question 5: What is the primary benefit of implementing threat modeling in the early stages of development?
- It ensures all threats are eliminated
- It reduces the cost of fixing security issues (Correct answer)
- It replaces penetration testing
- It increases software complexity
Correct answer: It reduces the cost of fixing security issues
Early threat modeling reduces the cost and effort of fixing security vulnerabilities compared to addressing them post-deployment.
Question 6: Which security principle is essential in mitigating threats identified in threat modeling?
- Granting full access to all users
- The principle of least privilege (Correct answer)
- Delaying security assessments
- Disabling encryption for faster access
Correct answer: The principle of least privilege
The principle of least privilege ensures that users and processes have only the necessary permissions, minimizing potential attack vectors.
App Security Engineer Threat Modeling
What is the primary goal of threat modeling?