SDL Threat Modeling & Risk Assessment 5 — Questions and Answers
Question 1: An application allows users to upload XML files that are parsed server-side. Which threat should be the HIGHEST priority in the threat model?
- Cross-Site Scripting (XSS)
- XML External Entity (XXE) injection (Correct answer)
- SQL injection
- Cross-Site Request Forgery (CSRF)
Correct answer: XML External Entity (XXE) injection
Server-side XML parsing of user-supplied content is the textbook XXE scenario, where malicious entity references can exfiltrate files or trigger SSRF.
Question 2: In the VAST (Visual, Agile, and Simple Threat modeling) methodology, threat models are divided into which two types?
- Attacker-focused and defender-focused models
- Application and operational threat models (Correct answer)
- Static and dynamic threat models
- External and internal threat models
Correct answer: Application and operational threat models
VAST distinguishes Application Threat Models (for developers, focused on design) from Operational Threat Models (for infrastructure and DevOps teams).
Question 3: Which metric in CVSS v3 reflects the degree to which the exploited component can affect components beyond its security scope?
- Attack Complexity
- Privileges Required
- Scope (Correct answer)
- User Interaction
Correct answer: Scope
The Scope metric captures whether exploitation of one component can impact resources managed by a different security authority (Changed vs. Unchanged).
Question 4: What is the recommended action when a threat identified in a threat model cannot be mitigated due to technical or business constraints?
- Remove the threat from the model so it does not inflate risk scores
- Document the threat as accepted risk with a named approver and review date (Correct answer)
- Defer it to the next major release without formal tracking
- Escalate to the security team and halt development
Correct answer: Document the threat as accepted risk with a named approver and review date
SDL requires formally documenting accepted risks with an accountable approver and a scheduled review date rather than silently ignoring unmitigated threats.
Question 5: A financial application processes payment data and logs full credit card numbers to a debug log file. Under STRIDE, which two threats are MOST directly present?
- Spoofing and Tampering
- Information Disclosure and Repudiation (Correct answer)
- Denial of Service and Elevation of Privilege
- Tampering and Elevation of Privilege
Correct answer: Information Disclosure and Repudiation
Logging PAN data exposes sensitive information (Information Disclosure), and the logs could allow users to deny transactions if log integrity is not assured (Repudiation).
Question 6: Which practice ensures that third-party and open-source components are included in the SDL threat model scope?
- Vendor security questionnaires
- Software Composition Analysis (SCA) integrated with the threat model (Correct answer)
- Manual code review of all dependencies
- Requiring vendors to provide penetration test reports
Correct answer: Software Composition Analysis (SCA) integrated with the threat model
SCA tools inventory all third-party components and their known vulnerabilities, ensuring the threat model reflects risks from the full dependency tree.
Question 7: When applying the STRIDE-per-Element approach, which element type is typically associated with the FULL set of STRIDE threats?
- External entities
- Data stores
- Data flows
- Processes (Correct answer)
Correct answer: Processes
Processes can be subject to all six STRIDE threats because they execute logic, handle identity, read/write data, perform logging, transmit data, and hold privileges.
SDL Threat Modeling & Risk Assessment 5
An application allows users to upload XML files that are parsed server-side.
Which threat should be the HIGHEST priority in the threat model?