SDL Threat Modeling & Risk Assessment 2

Question 1

In the PASTA (Process for Attack Simulation and Threat Analysis) methodology, what is the primary focus of Stage 7?

Accepted Answer

Enumerate attack patterns and paths

Answer

Stage 7 of PASTA focuses on enumerating attack patterns and paths that can be exploited to reach the identified attack surface.

Question 2

Which threat modeling approach is best suited when the team wants to think like an attacker and enumerate attack patterns first?

Accepted Answer

Attack-centric modeling

Answer

Attack-centric threat modeling starts from known attack patterns (e.g., CAPEC) to reason about how an adversary would compromise the system.

Question 3

When assigning a DREAD score, the 'Affected Users' component is used to measure what?

Accepted Answer

The number or proportion of users impacted if the threat is realized

Answer

'Affected Users' in DREAD quantifies the breadth of impact — how many users would be harmed if the threat is successfully exploited.

Question 4

A developer discovers that an unauthenticated API endpoint returns internal server version strings. Under STRIDE, which threat category best describes this?

Accepted Answer

Information Disclosure

Answer

Exposing internal version information to unauthenticated callers is an Information Disclosure threat, as it leaks data that aids attackers.

Question 5

In a Data Flow Diagram (DFD) used for threat modeling, what does a double-lined rectangle symbol represent?

Accepted Answer

A data store

Answer

In DFDs, a double-lined rectangle (or parallel lines) represents a data store — a location where data is held at rest.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Threat Modeling & Risk Assessment 2