Question 50 Before designing an Internet-connected payment API, the team wants to identify trust-boundary threats. What should it do? Analyze tampering of messages and verify integrity protection across that boundary Evaluate elevation-of-privilege and authentication/authorization bypass paths Revisit models when architecture and trust relationships change, using multidisciplinary review Draw data flows and trust boundaries, then analyze threats against each interaction Explanation Correct Answer D:Structured modeling identifies attack opportunities before implementation, rather than relying on post-deployment alerts. Incorrect Answers A:The other scenario states that an attacker may alter telemetry crossing a low-trust broker boundary, where unauthorized data modification differs from spoofing identity or denying service; by contrast, the present case requires draw data flows and trust boundaries, then analyze threats against each interaction. B:The other scenario states that a system exposes an admin API that can be invoked anonymously, where a public high-privilege entry point threatens access boundaries more directly than only service performance; by contrast, the present case requires draw data flows and trust boundaries, then analyze threats against each interaction. C:For the separate situation in which a development team is concerned about missing threat scenarios in one microservice, threat models require iteration and reviewer perspectives as assumptions evolve; here the stated problem requires draw data flows and trust boundaries, then analyze threats against each interaction.
Question 51 Threat modeling lists potential attacks but no design owners or mitigations. What is the essential next step? Evaluate elevation-of-privilege and authentication/authorization bypass paths Prioritize feasible threats and assign explicit treatment decisions to design owners Revisit models when architecture and trust relationships change, using multidisciplinary review Analyze tampering of messages and verify integrity protection across that boundary Explanation Correct Answer B:A model should drive justified design changes with accountability, not remain an unowned list. Incorrect Answers A:A public high-privilege entry point threatens access boundaries more directly than only service performance; this responds to the different circumstance in which a system exposes an admin API that can be invoked anonymously, while the current case states that threat modeling lists potential attacks but no design owners or mitigations, calling for prioritize feasible threats and assign explicit treatment decisions to design owners. C:Threat models require iteration and reviewer perspectives as assumptions evolve; this responds to the different circumstance in which a development team is concerned about missing threat scenarios in one microservice, while the current case states that threat modeling lists potential attacks but no design owners or mitigations, calling for prioritize feasible threats and assign explicit treatment decisions to design owners. D:The other scenario states that an attacker may alter telemetry crossing a low-trust broker boundary, where unauthorized data modification differs from spoofing identity or denying service; by contrast, the present case requires prioritize feasible threats and assign explicit treatment decisions to design owners.
Question 52 An attacker may alter telemetry crossing a low-trust broker boundary. Which threat category is most direct? Draw data flows and trust boundaries, then analyze threats against each interaction Analyze tampering of messages and verify integrity protection across that boundary Revisit models when architecture and trust relationships change, using multidisciplinary review Prioritize feasible threats and assign explicit treatment decisions to design owners Explanation Correct Answer B:Unauthorized data modification differs from spoofing identity or denying service. Incorrect Answers A:For the separate situation in which before designing an Internet-connected payment API, the team wants to identify trust-boundary threats, structured modeling identifies attack opportunities before implementation, rather than relying on post-deployment alerts; here the stated problem requires analyze tampering of messages and verify integrity protection across that boundary. C:The other scenario states that a development team is concerned about missing threat scenarios in one microservice, where threat models require iteration and reviewer perspectives as assumptions evolve; by contrast, the present case requires analyze tampering of messages and verify integrity protection across that boundary. D:This option fits a different fact pattern where threat modeling lists potential attacks but no design owners or mitigations: a model should drive justified design changes with accountability, not remain an unowned list; the current case instead requires analyze tampering of messages and verify integrity protection across that boundary.
Question 53 A system exposes an admin API that can be invoked anonymously. Which design threat should be evaluated? Evaluate elevation-of-privilege and authentication/authorization bypass paths Analyze tampering of messages and verify integrity protection across that boundary Prioritize feasible threats and assign explicit treatment decisions to design owners Draw data flows and trust boundaries, then analyze threats against each interaction Explanation Correct Answer A:A public high-privilege entry point threatens access boundaries more directly than only service performance. Incorrect Answers B:Unauthorized data modification differs from spoofing identity or denying service; although this helps when an attacker may alter telemetry crossing a low-trust broker boundary, it leaves the current case's need to evaluate elevation-of-privilege and authentication/authorization bypass paths unresolved. C:A model should drive justified design changes with accountability, not remain an unowned list; it is relevant where threat modeling lists potential attacks but no design owners or mitigations, whereas the current facts require evaluate elevation-of-privilege and authentication/authorization bypass paths to address the stated problem. D:The other scenario states that before designing an Internet-connected payment API, the team wants to identify trust-boundary threats, where structured modeling identifies attack opportunities before implementation, rather than relying on post-deployment alerts; by contrast, the present case requires evaluate elevation-of-privilege and authentication/authorization bypass paths.
Question 54 A development team is concerned about missing threat scenarios in one microservice. Which improvement is most defensible? Draw data flows and trust boundaries, then analyze threats against each interaction Revisit models when architecture and trust relationships change, using multidisciplinary review Evaluate elevation-of-privilege and authentication/authorization bypass paths Prioritize feasible threats and assign explicit treatment decisions to design owners Explanation Correct Answer B:Threat models require iteration and reviewer perspectives as assumptions evolve. Incorrect Answers A:The other scenario states that before designing an Internet-connected payment API, the team wants to identify trust-boundary threats, where structured modeling identifies attack opportunities before implementation, rather than relying on post-deployment alerts; by contrast, the present case requires revisit models when architecture and trust relationships change, using multidisciplinary review. C:A public high-privilege entry point threatens access boundaries more directly than only service performance; although this helps when a system exposes an admin API that can be invoked anonymously, it leaves the current case's need to revisit models when architecture and trust relationships change, using multidisciplinary review unresolved. D:For the separate situation in which threat modeling lists potential attacks but no design owners or mitigations, a model should drive justified design changes with accountability, not remain an unowned list; here the stated problem requires revisit models when architecture and trust relationships change, using multidisciplinary review.
Question 55 An equipment supplier refuses to disclose its security patching commitments for network controllers. What should procurement require? Establish contractually measurable support, vulnerability disclosure and update obligations Validate signed firmware, provenance and authorized distribution paths before deployment Require vulnerability intake, impact evaluation and timely remediation procedures linked to the SBOM Assess provenance, maintainer practices and dependency exposure before approving adoption Explanation Correct Answer A:Support and remediation assurances are part of supply-chain security rather than optional marketing claims. Incorrect Answers B:The other scenario states that the same hardware model from different distributors has inconsistent firmware hashes, where supply-chain tampering may be revealed through integrity verification independent of purchase receipts; by contrast, the present case requires establish contractually measurable support, vulnerability disclosure and update obligations. C:A component inventory enables response but does not itself close exploitable dependencies; this responds to the different circumstance in which a vendor provides an SBOM but no process to handle newly disclosed component weaknesses, while the current case states that an equipment supplier refuses to disclose its security patching commitments for network controllers, calling for establish contractually measurable support, vulnerability disclosure and update obligations. D:Open-source availability does not independently verify source integrity or governance sustainability; although this helps when a critical library is maintained by a single anonymous contributor, it leaves the current case's need to establish contractually measurable support, vulnerability disclosure and update obligations unresolved.
Question 56 A critical library is maintained by a single anonymous contributor. How should acquisition risk be evaluated? Establish contractually measurable support, vulnerability disclosure and update obligations Assess provenance, maintainer practices and dependency exposure before approving adoption Evaluate substitutable providers and continuity commitments as part of third-party risk treatment Require vulnerability intake, impact evaluation and timely remediation procedures linked to the SBOM Explanation Correct Answer B:Open-source availability does not independently verify source integrity or governance sustainability. Incorrect Answers A:Support and remediation assurances are part of supply-chain security rather than optional marketing claims; it is relevant where an equipment supplier refuses to disclose its security patching commitments for network controllers, whereas the current facts require assess provenance, maintainer practices and dependency exposure before approving adoption to address the stated problem. C:Concentration risk can persist despite strong cybersecurity controls at the incumbent vendor; it is relevant where one logistics vendor is a single point of failure for a regulated service, whereas the current facts require assess provenance, maintainer practices and dependency exposure before approving adoption to address the stated problem. D:A component inventory enables response but does not itself close exploitable dependencies; it is relevant where a vendor provides an SBOM but no process to handle newly disclosed component weaknesses, whereas the current facts require assess provenance, maintainer practices and dependency exposure before approving adoption to address the stated problem.
Question 57 The same hardware model from different distributors has inconsistent firmware hashes. What risk control best addresses this? Evaluate substitutable providers and continuity commitments as part of third-party risk treatment Establish contractually measurable support, vulnerability disclosure and update obligations Validate signed firmware, provenance and authorized distribution paths before deployment Assess provenance, maintainer practices and dependency exposure before approving adoption Explanation Correct Answer C:Supply-chain tampering may be revealed through integrity verification independent of purchase receipts. Incorrect Answers A:Concentration risk can persist despite strong cybersecurity controls at the incumbent vendor; this responds to the different circumstance in which one logistics vendor is a single point of failure for a regulated service, while the current case states that the same hardware model from different distributors has inconsistent firmware hashes, calling for validate signed firmware, provenance and authorized distribution paths before deployment. B:Support and remediation assurances are part of supply-chain security rather than optional marketing claims; although this helps when an equipment supplier refuses to disclose its security patching commitments for network controllers, it leaves the current case's need to validate signed firmware, provenance and authorized distribution paths before deployment unresolved. D:Open-source availability does not independently verify source integrity or governance sustainability; although this helps when a critical library is maintained by a single anonymous contributor, it leaves the current case's need to validate signed firmware, provenance and authorized distribution paths before deployment unresolved.
Question 58 A vendor provides an SBOM but no process to handle newly disclosed component weaknesses. What is missing? Validate signed firmware, provenance and authorized distribution paths before deployment Evaluate substitutable providers and continuity commitments as part of third-party risk treatment Require vulnerability intake, impact evaluation and timely remediation procedures linked to the SBOM Assess provenance, maintainer practices and dependency exposure before approving adoption Explanation Correct Answer C:A component inventory enables response but does not itself close exploitable dependencies. Incorrect Answers A:This option fits a different fact pattern where the same hardware model from different distributors has inconsistent firmware hashes: supply-chain tampering may be revealed through integrity verification independent of purchase receipts; the current case instead requires require vulnerability intake, impact evaluation and timely remediation procedures linked to the SBOM. B:Concentration risk can persist despite strong cybersecurity controls at the incumbent vendor; although this helps when one logistics vendor is a single point of failure for a regulated service, it leaves the current case's need to require vulnerability intake, impact evaluation and timely remediation procedures linked to the SBOM unresolved. D:Open-source availability does not independently verify source integrity or governance sustainability; this responds to the different circumstance in which a critical library is maintained by a single anonymous contributor, while the current case states that a vendor provides an SBOM but no process to handle newly disclosed component weaknesses, calling for require vulnerability intake, impact evaluation and timely remediation procedures linked to the SBOM.
Question 59 One logistics vendor is a single point of failure for a regulated service. What action is justified? Establish contractually measurable support, vulnerability disclosure and update obligations Evaluate substitutable providers and continuity commitments as part of third-party risk treatment Require vulnerability intake, impact evaluation and timely remediation procedures linked to the SBOM Validate signed firmware, provenance and authorized distribution paths before deployment Explanation Correct Answer B:Concentration risk can persist despite strong cybersecurity controls at the incumbent vendor. Incorrect Answers A:Support and remediation assurances are part of supply-chain security rather than optional marketing claims; this responds to the different circumstance in which an equipment supplier refuses to disclose its security patching commitments for network controllers, while the current case states that one logistics vendor is a single point of failure for a regulated service, calling for evaluate substitutable providers and continuity commitments as part of third-party risk treatment. C:The other scenario states that a vendor provides an SBOM but no process to handle newly disclosed component weaknesses, where a component inventory enables response but does not itself close exploitable dependencies; by contrast, the present case requires evaluate substitutable providers and continuity commitments as part of third-party risk treatment. D:The other scenario states that the same hardware model from different distributors has inconsistent firmware hashes, where supply-chain tampering may be revealed through integrity verification independent of purchase receipts; by contrast, the present case requires evaluate substitutable providers and continuity commitments as part of third-party risk treatment.
Question 60 Annual awareness training has 100% attendance but recurring credential disclosure. What evaluation should security adopt? Use segmented effectiveness metrics and targeted interventions without punitive public ranking Measure actual behavior with ethical simulations and targeted follow-up coaching Tailor role-based education to agent permissions, untrusted inputs and data protection Review content periodically using incidents, risk trends and updated job responsibilities Explanation Correct Answer B:Completion counts are activity measures, not proof that staff can resist risky interactions. Incorrect Answers A:Different risk patterns call for focused training that encourages reporting rather than concealment; it is relevant where a few departments repeatedly fail security simulations while others improve, whereas the current facts require measure actual behavior with ethical simulations and targeted follow-up coaching to address the stated problem. C:This option fits a different fact pattern where a new engineering team builds AI agents but generic awareness materials omit prompt-injection risks: risk-specific instruction gives developers practical behaviors for emerging technology use; the current case instead requires measure actual behavior with ethical simulations and targeted follow-up coaching. D:Awareness programs must adapt as the threat landscape and workforce change; although this helps when a training course is unchanged despite repeated incident lessons over three years, it leaves the current case's need to measure actual behavior with ethical simulations and targeted follow-up coaching unresolved.
