{"id":59718,"date":"2024-04-16T01:42:11","date_gmt":"2024-04-16T01:42:11","guid":{"rendered":"https:\/\/exam.pscnotes.com\/mcq\/?p=59718"},"modified":"2024-04-16T01:42:11","modified_gmt":"2024-04-16T01:42:11","slug":"in-threat-modeling-what-methodology-used-to-perform-risk-analysis","status":"publish","type":"post","link":"https:\/\/exam.pscnotes.com\/mcq\/in-threat-modeling-what-methodology-used-to-perform-risk-analysis\/","title":{"rendered":"In threat modeling, what methodology used to perform risk analysis"},"content":{"rendered":"<p>\r\n    <!-- Check if it's an AMP page -->\r\n            <!-- Non-AMP version -->\r\n        <div class=\"mcq-container\" data-quiz-id=\"quizState_6a96d51b8c9c0\">\r\n                                            <div class=\"option\" data-option-key=\"option1\" data-is-correct=\"false\">\r\n                    dread                <\/div>\r\n                                            <div class=\"option\" data-option-key=\"option2\" data-is-correct=\"false\">\r\n                    owasp                <\/div>\r\n                                            <div class=\"option\" data-option-key=\"option3\" data-is-correct=\"true\">\r\n                    stride                <\/div>\r\n                                            <div class=\"option\" data-option-key=\"option4\" data-is-correct=\"false\">\r\n                    dar                <\/div>\r\n                            \r\n            <!-- Feedback messages for non-AMP -->\r\n            <div class=\"feedback\" data-feedback=\"wrong\">Answer is Right!<\/div>\r\n            <div class=\"feedback\" data-feedback=\"right\">Answer is Wrong!<\/div>\r\n        <\/div>\r\n\r\n        <script>\r\n        document.addEventListener('DOMContentLoaded', function () {\r\n            var containers = document.querySelectorAll('.mcq-container');\r\n\r\n            containers.forEach(function(container) {\r\n                var options = container.querySelectorAll('.option');\r\n                var feedbackSelect = container.querySelector('[data-feedback=\"select\"]');\r\n                var feedbackWrong = container.querySelector('[data-feedback=\"wrong\"]');\r\n                var feedbackRight = container.querySelector('[data-feedback=\"right\"]');\r\n\r\n                options.forEach(function(option) {\r\n                    option.addEventListener('click', function() {\r\n                        var selectedOption = option.getAttribute('data-option-key');\r\n                        var isCorrect = option.getAttribute('data-is-correct') === 'true';\r\n\r\n                        \/\/ Remove previous selections\r\n                        options.forEach(function(opt) {\r\n                            opt.classList.remove('correct', 'incorrect');\r\n                        });\r\n\r\n                        \/\/ Add the correct\/incorrect class\r\n                        if (isCorrect) {\r\n                            option.classList.add('correct');\r\n                            feedbackRight.hidden = false;\r\n                            feedbackWrong.hidden = true;\r\n                        } else {\r\n                            option.classList.add('incorrect');\r\n                            feedbackRight.hidden = true;\r\n                            feedbackWrong.hidden = false;\r\n                        }\r\n\r\n                        \/\/ Hide select feedback\r\n                        feedbackSelect.hidden = true;\r\n                    });\r\n                });\r\n            });\r\n        });\r\n        <\/script>\r\n    \r\n    <!--more--><\/p>\n<p>The correct answer is <strong>C. STRIDE<\/strong>.<\/p>\n<p>STRIDE is a threat modeling methodology that stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. It is a systematic approach to identifying and assessing the risks posed to an information system.<\/p>\n<p>STRIDE is a valuable tool for organizations of all sizes, as it can help to identify potential threats and vulnerabilities that may not be apparent at first glance. By understanding the risks posed to an information system, organizations can take steps to mitigate those risks and protect their data and systems.<\/p>\n<p>Here is a brief explanation of each of the STRIDE threats:<\/p>\n<ul>\n<li>Spoofing: This is an attack in which an attacker impersonates a legitimate user in order to gain access to an information system.<\/li>\n<li>Tampering: This is an attack in which an attacker modifies data or code in an information system.<\/li>\n<li>Repudiation: This is an attack in which an attacker denies having performed an action that they actually did perform.<\/li>\n<li>Information disclosure: This is an attack in which an attacker gains access to confidential information.<\/li>\n<li>Denial of service: This is an attack in which an attacker prevents legitimate users from accessing an information system.<\/li>\n<li>Elevation of privilege: This is an attack in <div class=\"telegram-channel-container\">\r\n        <a href=\"https:\/\/t.me\/pscnotes2025\" target=\"_blank\" class=\"telegram-channel-button\">\r\n            <span class=\"telegram-icon\">\r\n                <svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 496 512\">\r\n                    <path fill=\"white\" d=\"M248,8C111,8,0,119,0,256s111,248,248,248s248-111,248-248S385,8,248,8z M362,177L320,367c-3,14-10,18-20,14l-56-41l-27,26 c-3,3-5,5-10,5l4-63L323,196c5-5-1-7-8-3l-98,62l-42-13c-9-3-10-9,2-14l162-63C351,160,365,164,362,177z\"\/>\r\n                <\/svg>\r\n            <\/span>\r\n            Join Our Telegram Channel\r\n        <\/a>\r\n    <\/div> which an attacker gains unauthorized access to higher-level privileges in an information system.<\/li>\n<\/ul>\n<p>STRIDE is a valuable tool for organizations of all sizes, as it can help to identify potential threats and vulnerabilities that may not be apparent at first glance. By understanding the risks posed to an information system, organizations can take steps to mitigate those risks and protect their data and systems.<\/p>\n<p>The other options are not as comprehensive as STRIDE.<\/p>\n<ul>\n<li><strong>DREAD<\/strong> is a threat modeling methodology that stands for Damage, Reproducibility, Exploitability, Affected users, and Discoverability. It is a simpler methodology than STRIDE, but it does not cover all of the potential threats to an information system.<\/li>\n<li><strong>OWASP<\/strong> is an organization that provides information and resources on web application security. It does not have a specific threat modeling methodology, but it <div class=\"youtube-subscribe-container\">\r\n        <a href=\"https:\/\/www.youtube.com\/channel\/UCNHT8lW-JmLC68rjBfZhdkg?sub_confirmation=1\" target=\"_blank\" class=\"youtube-subscribe-button\">\r\n            <span class=\"youtube-icon\">\r\n                <svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 576 512\">\r\n                    <path d=\"M549.7 124.1c-6.3-23.7-24.8-42.3-48.3-48.6C458.8 64 288 64 288 64S117.2 64 74.6 75.5c-23.5 6.3-42 24.9-48.3 48.6-11.4 42.9-11.4 132.3-11.4 132.3s0 89.4 11.4 132.3c6.3 23.7 24.8 41.5 48.3 47.8C117.2 448 288 448 288 448s170.8 0 213.4-11.5c23.5-6.3 42-24.2 48.3-47.8 11.4-42.9 11.4-132.3 11.4-132.3s0-89.4-11.4-132.3zm-317.5 213.5V175.2l142.7 81.2-142.7 81.2z\"\/>\r\n                <\/svg>\r\n            <\/span>\r\n            Subscribe on YouTube\r\n        <\/a>\r\n    <\/div> does provide guidance on how to perform threat modeling.<\/li>\n<li><strong>DAR<\/strong> is a threat modeling methodology that stands for Data, Attack surface, Risk, and Exposure. It is a newer methodology than STRIDE, but it is not as widely used.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Join Our Telegram Channel Subscribe on YouTube<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[728],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.2 (Yoast SEO v23.3) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>In threat modeling, what methodology used to perform risk analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/exam.pscnotes.com\/mcq\/in-threat-modeling-what-methodology-used-to-perform-risk-analysis\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"In threat modeling, what methodology used to perform risk analysis\" \/>\n<meta property=\"og:description\" content=\"Join Our Telegram Channel Subscribe on YouTube\" \/>\n<meta property=\"og:url\" content=\"https:\/\/exam.pscnotes.com\/mcq\/in-threat-modeling-what-methodology-used-to-perform-risk-analysis\/\" \/>\n<meta property=\"og:site_name\" content=\"MCQ and Quiz for Exams\" \/>\n<meta property=\"article:published_time\" content=\"2024-04-16T01:42:11+00:00\" \/>\n<meta name=\"author\" content=\"rawan239\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"rawan239\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"In threat modeling, what methodology used to perform risk analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/exam.pscnotes.com\/mcq\/in-threat-modeling-what-methodology-used-to-perform-risk-analysis\/","og_locale":"en_US","og_type":"article","og_title":"In threat modeling, what methodology used to perform risk analysis","og_description":"Join Our Telegram Channel Subscribe on YouTube","og_url":"https:\/\/exam.pscnotes.com\/mcq\/in-threat-modeling-what-methodology-used-to-perform-risk-analysis\/","og_site_name":"MCQ and Quiz for Exams","article_published_time":"2024-04-16T01:42:11+00:00","author":"rawan239","twitter_card":"summary_large_image","twitter_misc":{"Written by":"rawan239","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/exam.pscnotes.com\/mcq\/in-threat-modeling-what-methodology-used-to-perform-risk-analysis\/","url":"https:\/\/exam.pscnotes.com\/mcq\/in-threat-modeling-what-methodology-used-to-perform-risk-analysis\/","name":"In threat modeling, what methodology used to perform risk analysis","isPartOf":{"@id":"https:\/\/exam.pscnotes.com\/mcq\/#website"},"datePublished":"2024-04-16T01:42:11+00:00","dateModified":"2024-04-16T01:42:11+00:00","author":{"@id":"https:\/\/exam.pscnotes.com\/mcq\/#\/schema\/person\/5807dafeb27d2ec82344d6cbd6c3d209"},"breadcrumb":{"@id":"https:\/\/exam.pscnotes.com\/mcq\/in-threat-modeling-what-methodology-used-to-perform-risk-analysis\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/exam.pscnotes.com\/mcq\/in-threat-modeling-what-methodology-used-to-perform-risk-analysis\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/exam.pscnotes.com\/mcq\/in-threat-modeling-what-methodology-used-to-perform-risk-analysis\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/exam.pscnotes.com\/mcq\/"},{"@type":"ListItem","position":2,"name":"mcq","item":"https:\/\/exam.pscnotes.com\/mcq\/category\/mcq\/"},{"@type":"ListItem","position":3,"name":"Cloud computing","item":"https:\/\/exam.pscnotes.com\/mcq\/category\/mcq\/cloud-computing\/"},{"@type":"ListItem","position":4,"name":"In threat modeling, what methodology used to perform risk analysis"}]},{"@type":"WebSite","@id":"https:\/\/exam.pscnotes.com\/mcq\/#website","url":"https:\/\/exam.pscnotes.com\/mcq\/","name":"MCQ and Quiz for Exams","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/exam.pscnotes.com\/mcq\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/exam.pscnotes.com\/mcq\/#\/schema\/person\/5807dafeb27d2ec82344d6cbd6c3d209","name":"rawan239","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/exam.pscnotes.com\/mcq\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d97f17072bfa490596c8f78363955d55?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d97f17072bfa490596c8f78363955d55?s=96&d=mm&r=g","caption":"rawan239"},"sameAs":["https:\/\/exam.pscnotes.com"],"url":"https:\/\/exam.pscnotes.com\/mcq\/author\/rawan239\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/exam.pscnotes.com\/mcq\/wp-json\/wp\/v2\/posts\/59718"}],"collection":[{"href":"https:\/\/exam.pscnotes.com\/mcq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/exam.pscnotes.com\/mcq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/exam.pscnotes.com\/mcq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/exam.pscnotes.com\/mcq\/wp-json\/wp\/v2\/comments?post=59718"}],"version-history":[{"count":0,"href":"https:\/\/exam.pscnotes.com\/mcq\/wp-json\/wp\/v2\/posts\/59718\/revisions"}],"wp:attachment":[{"href":"https:\/\/exam.pscnotes.com\/mcq\/wp-json\/wp\/v2\/media?parent=59718"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/exam.pscnotes.com\/mcq\/wp-json\/wp\/v2\/categories?post=59718"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/exam.pscnotes.com\/mcq\/wp-json\/wp\/v2\/tags?post=59718"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}