Threat Modeling Concepts and Process Quiz BSIT 4A

What is threat modeling?

• The process of identifying, categorizing, and analyzing potential threats

• The process of designing and developing secure systems

• The process of testing and patching deployed products

• The process of reducing vulnerabilities and risks

When can threat modeling be performed?

• Only during the design and development phase

• Only after a product has been deployed

• Both during the design and development phase and after deployment

• None of the above

What are the goals of Microsoft's Security Development Lifecycle (SDL) process?

• To increase the number of security-related design and coding defects

• To increase the severity of any remaining defects

• To reduce the number of security-related design and coding defects

• To reduce the severity of any remaining defects

What is the proactive approach to threat modeling?

• Predicting threats and designing defenses during the coding process

• Relying on post-deployment updates and patches to address threats

• Crafting updates or patches to be added after deployment

• Starting over from scratch to produce better products

What is the reactive approach to threat modeling?

• Predicting threats and designing defenses during the coding process

• Relying on post-deployment updates and patches to address threats

• Crafting updates or patches to be added after deployment

• Starting over from scratch to produce better products

What is fuzz testing?

• A technique to stress software by supplying invalid input

• A technique to identify potential attackers and their goals

• A technique to identify vulnerabilities in software code

• A technique to simulate attacks and analyze their impact

What are the three approaches to identifying threats?

• Focused on assets, focused on attackers, focused on software

• Focused on assets, focused on vulnerabilities, focused on countermeasures

• Focused on attackers, focused on vulnerabilities, focused on countermeasures

• Focused on assets, focused on vulnerabilities, focused on attackers

What is the STRIDE threat model used for?

• Assessing threats against applications or operating systems

• Assessing threats against network infrastructure

• Assessing threats against physical security

• Assessing threats against social engineering

What is the PASTA threat modeling methodology?

• A risk-centric approach for selecting countermeasures

• A method of performing security audits

• A threat modeling concept based on Agile principles

• A threat categorization scheme developed by Microsoft

What is the Trike threat modeling methodology focused on?

• Aggregated threat modeling

• Risk-based approach

• Software architecture design

• Network and host concerns