SDL Threat Modeling & Risk Assessment 3 — Questions and Answers
Question 1: Which element of a threat model defines the channel over which an adversary communicates with a target system?
- Threat actor
- Attack vector (Correct answer)
- Vulnerability
- Security control
Correct answer: Attack vector
The attack vector describes the path or means by which a threat actor delivers an attack, such as network, physical access, or supply chain.
Question 2: In risk assessment, 'residual risk' is defined as the risk that remains after:
- The threat modeling exercise is completed
- All identified threats are documented
- Security controls have been applied (Correct answer)
- A penetration test has been performed
Correct answer: Security controls have been applied
Residual risk is the level of risk that persists after all planned mitigation controls have been implemented and accepted.
Question 3: A web application stores session tokens in URL query parameters. Which STRIDE threat does this most directly introduce?
- Spoofing
- Repudiation
- Information Disclosure (Correct answer)
- Denial of Service
Correct answer: Information Disclosure
Tokens in URLs are logged by servers, proxies, and browser history, exposing session credentials — a classic Information Disclosure threat.
Question 4: Which CVSS v3 metric group captures environmental factors specific to the organization deploying the software?
- Base metric group
- Temporal metric group
- Environmental metric group (Correct answer)
- Contextual metric group
Correct answer: Environmental metric group
The Environmental metric group allows organizations to adjust CVSS scores based on their specific deployment context, such as the importance of the affected system.
Question 5: In threat modeling, 'attack surface reduction' is best achieved by:
- Adding more authentication layers to all interfaces
- Eliminating or disabling unnecessary features, protocols, and entry points (Correct answer)
- Encrypting all data at rest and in transit
- Running the application with elevated privileges to prevent tampering
Correct answer: Eliminating or disabling unnecessary features, protocols, and entry points
Attack surface reduction means minimizing the number of pathways an attacker can use — achieved by removing unused features, APIs, services, and ports.
Question 6: Which threat modeling artifact explicitly captures assumptions about the security posture of external dependencies?
- Data Flow Diagram
- Trust boundary diagram
- Threat model assumptions log (Correct answer)
- Risk register
Correct answer: Threat model assumptions log
A threat model assumptions log records beliefs about the environment (e.g., 'the database server is on a trusted network') so they can be reviewed and challenged.
Question 7: Under the STRIDE model, which mitigation technique most directly addresses the 'Repudiation' threat?
- Input validation
- Secure audit logging and digital signatures (Correct answer)
- Role-based access control
- Network segmentation
Correct answer: Secure audit logging and digital signatures
Repudiation threats are countered by tamper-evident audit logs and digital signatures that prove who performed an action and when.
SDL Threat Modeling & Risk Assessment 3
Which element of a threat model defines the channel over which an adversary communicates with a target system?