Threat Modeling and Vulnerability Assessment Questions

Encompasses general threat modeling methodologies and vulnerability assessment practices for systems and applications. Topics include learning and applying structured methodologies such as STRIDE and PASTA, distinguishing threats vulnerabilities and risks, enumerating attack surfaces and likely exploits such as eavesdropping man in the middle and replay attacks, assessing likelihood and impact to prioritize mitigations, and using threat models to scope penetration testing and to evaluate the effectiveness of security controls. Candidates should demonstrate prioritization, mitigation planning, and how to validate controls under adversarial conditions.