SDL Threat Modeling & Risk Assessment 4 — Questions and Answers
Question 1: Which SDL phase is the FIRST recommended time to perform threat modeling?
- Implementation
- Design (Correct answer)
- Requirements
- Verification
Correct answer: Design
SDL recommends performing threat modeling during the Design phase so that architectural flaws can be corrected before code is written.
Question 2: When using TRIKE for threat modeling, the method differs from STRIDE primarily because TRIKE:
- Focuses exclusively on web application threats
- Derives threats systematically from a requirements model and risk acceptability rules (Correct answer)
- Uses attacker personas instead of threat categories
- Requires automated tool support to function
Correct answer: Derives threats systematically from a requirements model and risk acceptability rules
TRIKE generates a complete threat model by systematically applying rules to a requirements model, ensuring every actor-action-asset combination is evaluated.
Question 3: A cloud-hosted microservice exposes an internal metrics endpoint without authentication on port 9090. What is the most appropriate first action when this is found during threat modeling?
- Accept the risk because the port is non-standard
- Document it as a low-severity finding and revisit next quarter
- Add it to the attack surface inventory and assign an owner to remediate (Correct answer)
- Block the port at the perimeter firewall and close the threat model finding
Correct answer: Add it to the attack surface inventory and assign an owner to remediate
The correct SDL response is to formally add unauthenticated endpoints to the attack surface inventory, assign ownership, and drive remediation through the security process.
Question 4: In risk assessment, 'likelihood' combined with 'impact' produces what output?
- Vulnerability score
- Risk level (Correct answer)
- Threat severity
- Control effectiveness rating
Correct answer: Risk level
Risk = Likelihood × Impact; combining these two dimensions yields a risk level that prioritizes which threats require the most urgent mitigation.
Question 5: Which of the following best describes a 'trust boundary' in a threat model?
- A firewall rule that blocks external traffic
- The line separating components with different levels of trust or privilege (Correct answer)
- An encryption layer protecting data in transit
- A code review gate enforced before deployment
Correct answer: The line separating components with different levels of trust or privilege
A trust boundary marks where data or control passes between components operating under different privilege or trust levels, making it a prime location for threats.
Question 6: Which SDL tool is designed to automate the creation of threat models based on DFDs and STRIDE?
- Microsoft Threat Modeling Tool (Correct answer)
- OWASP ZAP
- Veracode Static Analysis
- CWE/SANS Top 25
Correct answer: Microsoft Threat Modeling Tool
The Microsoft Threat Modeling Tool ingests DFD diagrams, automatically applies STRIDE, and generates a list of potential threats for review.
Question 7: Which OWASP resource provides a structured catalog of attack patterns that teams can reference during threat modeling to ensure completeness?
- OWASP Top 10
- CAPEC (Common Attack Pattern Enumeration and Classification) (Correct answer)
- CVE (Common Vulnerabilities and Exposures)
- CWE (Common Weakness Enumeration)
Correct answer: CAPEC (Common Attack Pattern Enumeration and Classification)
CAPEC catalogs reusable attack patterns with descriptions, prerequisites, and mitigations, making it a reference for threat enumeration during modeling.
SDL Threat Modeling & Risk Assessment 4
Which SDL phase is the FIRST recommended time to perform threat modeling?