SDL Threat Modeling & Risk Assessment 2 — Questions and Answers
Question 1: In the PASTA (Process for Attack Simulation and Threat Analysis) methodology, what is the primary focus of Stage 7?
- Define business objectives
- Enumerate attack patterns and paths (Correct answer)
- Analyze the threat environment
- Develop a risk and impact analysis
Correct answer: Enumerate attack patterns and paths
Stage 7 of PASTA focuses on enumerating attack patterns and paths that can be exploited to reach the identified attack surface.
Question 2: Which threat modeling approach is best suited when the team wants to think like an attacker and enumerate attack patterns first?
- STRIDE
- VAST
- Attack-centric modeling (Correct answer)
- Asset-centric modeling
Correct answer: Attack-centric modeling
Attack-centric threat modeling starts from known attack patterns (e.g., CAPEC) to reason about how an adversary would compromise the system.
Question 3: When assigning a DREAD score, the 'Affected Users' component is used to measure what?
- The likelihood that a vulnerability will be discovered
- The number or proportion of users impacted if the threat is realized (Correct answer)
- The ease with which an attacker can reproduce the attack
- The technical skill required to exploit the vulnerability
Correct answer: The number or proportion of users impacted if the threat is realized
'Affected Users' in DREAD quantifies the breadth of impact — how many users would be harmed if the threat is successfully exploited.
Question 4: A developer discovers that an unauthenticated API endpoint returns internal server version strings. Under STRIDE, which threat category best describes this?
- Spoofing
- Tampering
- Information Disclosure (Correct answer)
- Elevation of Privilege
Correct answer: Information Disclosure
Exposing internal version information to unauthenticated callers is an Information Disclosure threat, as it leaks data that aids attackers.
Question 5: In a Data Flow Diagram (DFD) used for threat modeling, what does a double-lined rectangle symbol represent?
- An external entity
- A data store (Correct answer)
- A process
- A trust boundary
Correct answer: A data store
In DFDs, a double-lined rectangle (or parallel lines) represents a data store — a location where data is held at rest.
Question 6: Which SDL activity ensures that threat model findings are re-evaluated after significant design changes late in development?
- Final Security Review (FSR)
- Security bug bar triage
- Threat model update (Correct answer)
- Penetration testing
Correct answer: Threat model update
The SDL requires updating the threat model whenever the design, architecture, or data flows change significantly, ensuring findings remain accurate.
Question 7: What is the primary purpose of establishing a 'bug bar' in Microsoft's SDL?
- To set the minimum number of security bugs that must be found before shipping
- To define severity thresholds that determine whether a security bug must be fixed before release (Correct answer)
- To prioritize features over security fixes in the backlog
- To track the total count of open security vulnerabilities
Correct answer: To define severity thresholds that determine whether a security bug must be fixed before release
The bug bar defines minimum security quality gates — bugs at or above a certain severity must be resolved before the product can ship.
SDL Threat Modeling & Risk Assessment 2
In the PASTA (Process for Attack Simulation and Threat Analysis) methodology, what is the primary focus of Stage 7?