SDL Threat Modeling & Risk Assessment 5

Question 1

An application allows users to upload XML files that are parsed server-side. Which threat should be the HIGHEST priority in the threat model?

Accepted Answer

XML External Entity (XXE) injection

Answer

Server-side XML parsing of user-supplied content is the textbook XXE scenario, where malicious entity references can exfiltrate files or trigger SSRF.

Question 2

In the VAST (Visual, Agile, and Simple Threat modeling) methodology, threat models are divided into which two types?

Accepted Answer

Application and operational threat models

Answer

VAST distinguishes Application Threat Models (for developers, focused on design) from Operational Threat Models (for infrastructure and DevOps teams).

Question 3

Which metric in CVSS v3 reflects the degree to which the exploited component can affect components beyond its security scope?

Accepted Answer

Scope

Answer

The Scope metric captures whether exploitation of one component can impact resources managed by a different security authority (Changed vs. Unchanged).

Question 4

What is the recommended action when a threat identified in a threat model cannot be mitigated due to technical or business constraints?

Accepted Answer

Document the threat as accepted risk with a named approver and review date

Answer

SDL requires formally documenting accepted risks with an accountable approver and a scheduled review date rather than silently ignoring unmitigated threats.

Question 5

A financial application processes payment data and logs full credit card numbers to a debug log file. Under STRIDE, which two threats are MOST directly present?

Accepted Answer

Information Disclosure and Repudiation

Answer

Logging PAN data exposes sensitive information (Information Disclosure), and the logs could allow users to deny transactions if log integrity is not assured (Repudiation).

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Threat Modeling & Risk Assessment 5