SDL Threat Modeling & Risk Assessment 3

Question 1

Which element of a threat model defines the channel over which an adversary communicates with a target system?

Accepted Answer

Attack vector

Answer

The attack vector describes the path or means by which a threat actor delivers an attack, such as network, physical access, or supply chain.

Question 2

In risk assessment, 'residual risk' is defined as the risk that remains after:

Accepted Answer

Security controls have been applied

Answer

Residual risk is the level of risk that persists after all planned mitigation controls have been implemented and accepted.

Question 3

A web application stores session tokens in URL query parameters. Which STRIDE threat does this most directly introduce?

Accepted Answer

Information Disclosure

Answer

Tokens in URLs are logged by servers, proxies, and browser history, exposing session credentials — a classic Information Disclosure threat.

Question 4

Which CVSS v3 metric group captures environmental factors specific to the organization deploying the software?

Accepted Answer

Environmental metric group

Answer

The Environmental metric group allows organizations to adjust CVSS scores based on their specific deployment context, such as the importance of the affected system.

Question 5

In threat modeling, 'attack surface reduction' is best achieved by:

Accepted Answer

Eliminating or disabling unnecessary features, protocols, and entry points

Answer

Attack surface reduction means minimizing the number of pathways an attacker can use — achieved by removing unused features, APIs, services, and ports.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Threat Modeling & Risk Assessment 3