CySA+ Threat Modeling Frameworks Quiz

1. Which threat modeling framework is specifically designed for enterprise risk management?

STRIDE

PASTA

OCTAVE

Trike

2. Which threat modeling approach uses a tree structure to map attack scenarios and their prerequisites?

STRIDE

PASTA

Attack Trees

Data Flow Diagrams

Submit

4. Which of the following best describes the 'Information Disclosure' threat in STRIDE?

Unauthorized exposure or access to sensitive data

Modification of system configuration files

Prevention of legitimate user access

Assumption of another user's identity

5. True or False: Threat modeling is primarily a one-time activity performed at project inception.

True

False

6. In threat modeling, what does 'trust boundary' represent?

A line separating components with different security levels or privilege domains

The physical perimeter of a data center

User authentication credentials

Network firewall rules

Submit

8. Which phase of PASTA involves identifying and documenting potential attack scenarios?

Stage 1: Define Objectives

Stage 3: Application Decomposition

Stage 4: Threat Analysis

Stage 5: Vulnerability Analysis

9. What is 'Repudiation' in the STRIDE framework?

Denial of performing an action or transaction

Interruption of service availability

Unauthorized system access

Modification of audit logs

10. True or False: Threat modeling eliminates the need for penetration testing.

True

False

11. What does the STRIDE threat modeling framework stand for?

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege

Secure, Trusted, Reliable, Identified, Documented, Encrypted

System, Threat, Risk, Impact, Detection, Evaluation

Scanning, Testing, Reporting, Investigation, Documentation, Escalation

Submit

13. What is the primary purpose of data flow diagrams (DFDs) in threat modeling?

To visualize how data moves through a system and identify potential attack surfaces

To document employee access privileges

To create system backup procedures

To outline network bandwidth requirements

14. Which threat modeling approach is most effective for identifying zero-day vulnerabilities?

Purely relying on known threat databases

Creative adversarial thinking and assumption of compromise

Manual code review only

Automated vulnerability scanners exclusively

15. In the OCTAVE framework, which phase focuses on identifying organizational risks and assets?

Phase 1: Build Organizational Drivers

Phase 2: Profile Current State

Phase 3: Conduct Risk Analysis

Phase 4: Develop Strategy

16. True or False: Threat modeling should only be performed once during the initial system design phase.

True

False

17. Which of the following is a primary advantage of attack tree analysis in threat modeling?

It eliminates the need for vulnerability scanning

It visually represents attack paths and prerequisites

It automatically patches all identified vulnerabilities

It requires no technical expertise to execute

Submit

19. In STRIDE, what does 'Tampering' refer to?

Unauthorized modification of data or system components

Unauthorized access to sensitive information

Interruption of system availability

Falsifying user identity or credentials

20. Which threat modeling methodology uses a seven-stage process and emphasizes business context?

STRIDE

PASTA

OCTAVE

Attack Trees

CySA+ Threat Modeling Frameworks Quiz

1. Which threat modeling framework is specifically designed for enterprise risk management?

2.

What first name or nickname would you like us to use?

2. Which threat modeling approach uses a tree structure to map attack scenarios and their prerequisites?

3. Threat modeling frameworks help organizations prioritize security remediation based on ____ and impact.

4. Which of the following best describes the 'Information Disclosure' threat in STRIDE?

5. True or False: Threat modeling is primarily a one-time activity performed at project inception.

6. In threat modeling, what does 'trust boundary' represent?

7. Asset valuation and threat likelihood assessment are key components of ____ analysis in threat modeling.

8. Which phase of PASTA involves identifying and documenting potential attack scenarios?

9. What is 'Repudiation' in the STRIDE framework?

10. True or False: Threat modeling eliminates the need for penetration testing.

11. What does the STRIDE threat modeling framework stand for?

12. In STRIDE, 'Elevation of Privilege' represents gaining access with ____ permissions than originally granted.

13. What is the primary purpose of data flow diagrams (DFDs) in threat modeling?

14. Which threat modeling approach is most effective for identifying zero-day vulnerabilities?

15. In the OCTAVE framework, which phase focuses on identifying organizational risks and assets?

16. True or False: Threat modeling should only be performed once during the initial system design phase.

17. Which of the following is a primary advantage of attack tree analysis in threat modeling?

18. PASTA threat modeling is best suited for organizations that want to align security with ____.

19. In STRIDE, what does 'Tampering' refer to?

20. Which threat modeling methodology uses a seven-stage process and emphasizes business context?