CySA+ Threat Modeling Frameworks Quiz

1. Which vulnerability management activity involves identifying and cataloging all assets?

Asset inventory

Penetration testing

Patch management

Threat hunting

2. Which framework provides a systematic approach to identifying threats by analyzing business objectives and security controls?

PASTA

CVSS

NIST

ISO 27001

3. What is a 'false positive' in vulnerability scanning?

A reported vulnerability that does not actually exist

A missed vulnerability during scanning

A vulnerability that affects multiple systems

A vulnerability patched within the last week

4. Which vulnerability management control involves applying software updates?

Patch management

Configuration management

Change management

Incident management

5. In PASTA, what does the 'T' represent?

Threat

Technical

Testing

Tactical

6. What is the typical output of a vulnerability scan?

A report listing discovered vulnerabilities with severity ratings

A list of all network-connected devices

Recommendations for hardware upgrades

A timeline of past security incidents

7. Which term describes the practice of accepting risk when mitigation costs exceed potential impact?

Risk acceptance

Risk avoidance

Risk mitigation

Risk transfer

8. What is the primary goal of threat modeling?

Identify and prioritize potential security threats systematically

Eliminate all possible vulnerabilities

Monitor real-time attack attempts

Deploy security patches immediately

9. In vulnerability prioritization, which factor typically receives highest priority?

High CVSS score with active exploitation

Low CVSS score with no known exploits

Vulnerabilities in unused systems

Recently discovered but unconfirmed flaws

10. What does DREAD stand for in threat modeling?

Damage, Reproducibility, Exploitability, Affected Users, Discoverability

Detection, Response, Execution, Analysis, Deployment

Data, Risk, Exposure, Assessment, Defense

Denial, Replay, Escalation, Access, Deviation

11. Which threat modeling framework uses the acronym STRIDE?

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege

Security Threat Risk Identification Design Evaluation

Systematic Threat Response and Incident Detection Execution

Structured Threat Risk Impact Data Evaluation

12. What is the primary advantage of using qualitative risk assessment in vulnerability management?

Faster evaluation without requiring precise numerical data

Provides exact financial loss predictions

Eliminates the need for vulnerability scanning

Guarantees complete risk elimination

13. In CVSS v3.1, what does the 'Scope' metric indicate?

Whether vulnerability impacts resources beyond the vulnerable component

The geographic scope of affected systems

The number of users impacted

The time required to exploit the flaw

14. Which threat modeling phase involves identifying assets, entry points, and data flows?

Decomposition

Threat profiling

Vulnerability analysis

Mitigation planning

15. What is a zero-day vulnerability?

A flaw unknown to the vendor with no patch available

A vulnerability patched within 24 hours

A flaw affecting zero systems

A vulnerability in deprecated software

16. Which risk calculation model uses Probability × Impact?

Qualitative risk assessment

Quantitative risk assessment

CVSS scoring

Vulnerability scanning

17. In vulnerability management, what does the term 'remediation' refer to?

Taking corrective action to eliminate a vulnerability

Documenting all discovered vulnerabilities

Scanning systems for security issues

Monitoring vulnerability exploit attempts

18. Which CVSS component measures the ease of exploiting a vulnerability?

Attack Complexity

Confidentiality Impact

Privileges Required

User Interaction

19. What is the primary purpose of attack trees in threat modeling?

Visualize hierarchical attack paths and root causes

Monitor real-time network traffic

Generate security patches automatically

Encrypt sensitive data at rest

20. PASTA threat modeling stands for which of the following?

Process for Attack Simulation and Threat Analysis

Prioritized Assessment and Security Threat Approach

Procedural Audit Security Threat Assessment

Preliminary Attack Surface Threat Analysis