Threat Modeling (PenTest+) Attack Surface Quiz

1. True or False: Threat modeling should only be performed on external-facing applications.

True

False

2. True or False: Threat modeling is only relevant for large enterprises.

True

False

3. What is the purpose of assigning risk scores in threat modeling?

To prioritize which threats to address first

To guarantee threat elimination

To replace security awareness training

To satisfy compliance audits only

4. Which element is critical when mapping an application's attack surface?

All network interfaces and communication protocols

Employee phone numbers

Office furniture inventory

Parking space assignments

5. In threat modeling, 'Spoofing' refers to which action?

Impersonating another user or system

Permanently deleting data

Slowing down network traffic

Installing antivirus software

6. True or False: Attack surface mapping is a one-time activity.

True

False

7. Which STRIDE threat involves unauthorized changes to data?

Tampering with Data

Information Disclosure

Elevation of Privilege

Denial of Service

8. What is the primary advantage of using a structured threat modeling methodology?

It ensures systematic identification and prioritization of threats

It eliminates all security vulnerabilities

It removes the need for penetration testing

It guarantees 100% system uptime

9. In threat modeling, what is a 'threat actor'?

An entity that could exploit vulnerabilities or cause harm

A penetration tester performing authorized testing

A security consultant reviewing systems

A network administrator managing firewall rules

10. Which of the following is a valid entry point in attack surface mapping?

A web form accepting user input

An employee's personal email

A locked file cabinet

A company parking lot

11. What is the primary goal of threat modeling in penetration testing?

Identify and prioritize potential security threats and vulnerabilities

Execute all possible attacks on a system

Document only confirmed vulnerabilities

Replace penetration testing entirely

12. What does 'E' represent in the DREAD risk rating model?

Exploitability

Exposure

Escalation

Elimination

13. Which threat modeling approach focuses on 'what can go wrong'?

Threat-centric (STRIDE)

Asset-centric approach

Compliance-only approach

Cost-benefit analysis

14. In threat modeling, what is a 'trust boundary'?

A line separating components with different trust levels

The perimeter of a building

A security clearance level

A firewall rule set

15. What is a data flow diagram (DFD) used for in threat modeling?

Visualizing how data moves between system components

Creating employee organizational charts

Documenting server hardware specifications

Recording employee access logs

16. Which component is NOT typically part of attack surface analysis?

Employee vacation schedules

Network ports and protocols

APIs and web services

User input validation mechanisms

17. What does DREAD stand for in threat modeling?

Damage, Reproducibility, Exploitability, Affected users, Discoverability

Detection, Response, Escalation, Assessment, Defense

Data, Routing, Encryption, Access, Deployment

Denial, Reverse-engineering, Execution, Audit, Disabling

18. In the STRIDE model, 'Repudiation' refers to what type of threat?

An attacker denying they performed an action

Unauthorized data modification

Loss of system availability

Disclosure of sensitive information

19. STRIDE is a threat modeling framework. What does the 'T' stand for?

Tampering

Testing

Tracking

Targeting

20. Which of the following best describes an attack surface?

All points where an attacker can enter or extract data from a system

Only the external firewall of an organization

The physical location of servers

A document listing all employees

Threat Modeling Quiz: Can You Map the Attack Surface?

1. True or False: Threat modeling should only be performed on external-facing applications.

2.

What first name or nickname would you like us to use?

2. True or False: Threat modeling is only relevant for large enterprises.

3. What is the purpose of assigning risk scores in threat modeling?

4. Which element is critical when mapping an application's attack surface?

5. In threat modeling, 'Spoofing' refers to which action?

6. True or False: Attack surface mapping is a one-time activity.

7. Which STRIDE threat involves unauthorized changes to data?

8. What is the primary advantage of using a structured threat modeling methodology?

9. In threat modeling, what is a 'threat actor'?

10. Which of the following is a valid entry point in attack surface mapping?

11. What is the primary goal of threat modeling in penetration testing?

12. What does 'E' represent in the DREAD risk rating model?

13. Which threat modeling approach focuses on 'what can go wrong'?

14. In threat modeling, what is a 'trust boundary'?

15. What is a data flow diagram (DFD) used for in threat modeling?

16. Which component is NOT typically part of attack surface analysis?

17. What does DREAD stand for in threat modeling?

18. In the STRIDE model, 'Repudiation' refers to what type of threat?

19. STRIDE is a threat modeling framework. What does the 'T' stand for?

20. Which of the following best describes an attack surface?