Threat Modeling and Risk Assessment Questions

Systematic identification and evaluation of threats, vulnerabilities, assets, and attack surfaces to determine likelihood and business impact and to drive prioritized security controls. This topic covers threat modeling techniques and structured methodologies such as STRIDE, PASTA, and attack trees, enumeration of threat actors and attack vectors, scenario based attack simulation, and attack surface analysis. Candidates should be able to quantify risk using likelihood and impact, risk matrices, and concepts such as risk velocity, and explain how to integrate threat intelligence into probability assessments. The topic includes translating threat models into prioritized mitigations, detection and monitoring requirements, and security architecture or design trade offs that balance security with business objectives and operational constraints. At larger scale it covers enterprise risk assessment practices, alignment with risk management frameworks such as NIST and ISO 31000, integration with vulnerability assessment and vulnerability management programs, risk quantification, and effective communication of risk and remediation priorities to technical teams and executive stakeholders.

MediumTechnical

52 practiced

Scenario: Executives are demanding immediate patching of dozens of low-impact systems, diverting resources from a high-risk internet-facing service. As an analyst, how do you use risk assessment outputs to re-prioritize remediation, persuade stakeholders with data, and propose an acceptable mitigation plan balancing security and business needs?

EasyTechnical

78 practiced

List and profile common types of threat actors (e.g., script kiddies, cybercrime gangs, insiders, nation-state actors). For each type, describe typical motives, capabilities, and example attack vectors they would likely use against a financial services organization.

HardSystem Design

75 practiced

Design an enterprise-scale threat modeling program for a multinational organization. Describe program governance (centralized vs federated), roles and responsibilities, toolchain (including automation and the types of tools), workflows for onboarding new systems, integration points with SDLC and vulnerability management, and measurable success metrics you would track.

Sample Answer

**Program overview**I’d build a hybrid, primarily federated threat-modeling program with a central Center of Excellence (CoE). The CoE sets standards, tooling, playbooks and metrics; business units run models for their systems with CoE mentoring. This balances consistency with domain knowledge and scale.

**Governance & roles**- CoE: program owner, threat intel, methodology, quality assurance.- InfoSec Analyst (me): run models, integrate findings into detection and vuln triage, automate checks.- System owners/architects: provide architecture, accept mitigations.- AppSec/Dev teams: implement fixes, update designs.- Risk/Compliance: accept residual risk and track exceptions.

**Toolchain & automation**- Modeling: structured templates (STRIDE/PASTA) + threat-modeling platform (e.g., IriusRisk, ThreatModeler).- Artifact repo: CMDB / service catalog integration.- Automation: CI/CD hooks that validate design gates, IaC scanners (tfsec), SAST/DAST, automated threat-model generation from architecture diagrams, and ticketing integration (Jira).- Integration: SIEM (Splunk/Elastic) and VM tools (Tenable, Qualys) for mapping vulnerabilities to threats.

**Onboarding workflow**1. Intake via service catalog → assign risk tier.2. CoE provides template; InfoSec Analyst facilitates workshop with architects.3. Produce model, risk register, mitigation plan, Jira remediation tasks.4. Revalidate pre-prod via CI gates; sign-off to prod.

**SDLC & VM integration**- Mandatory threat model at design phase; automated checks in CI.- Vulnerability findings automatically correlate to threat model entries; prioritized by exploitability and business impact; detection content updated in SIEM.

**Success metrics**- % systems with completed models by tier and SLA- Mean time to remediate (MTTR) high-risk findings- Number of critical vulnerabilities traced to missing/failed mitigations- False-positive rate of automated mappings- Time from model to CI gate enforcement

This approach ensures scalable coverage, actionable outputs for my analyst workflow, and measurable risk reduction.

HardTechnical

56 practiced

Model supply-chain threats involving third-party libraries, CI/CD tool compromise, and vendor access. Propose layered mitigations across development, build, and runtime (e.g., SBOM, signed artifacts, least-privileged CI agents) and describe how to assess residual risk and require vendor attestations or contractual SLAs.

Sample Answer

**Situation & goal (brief)** As an InfoSec Analyst I’d model threats across dev → build → runtime for third-party libraries, compromised CI/CD, and vendor access, then define layered mitigations and a residual-risk/attestation process.

**Threat model (high-level)** - Malicious/compromised dependency (typosquatting, poisoned release) - CI/CD compromise (malicious pipeline step, exposed secrets, rogue agent) - Vendor system/administrative access abused

**Layered mitigations**

Development- Enforce vetted dependency sources: allowlist registries, dependency scanning (SCA) at PR time, SBOM generation per build. - Developer training on supply-chain risks and secure dependency review.

Build / CI- Least-privileged ephemeral CI agents; no long-lived credentials on agents. - Sign commits and artifact provenance (in-toto, Sigstore/Cosign); require signed builds. - Secrets in vaults with short TTL and OIDC-based access for CI. - Immutable build environment (container images from approved base) and reproducible builds. - CI pipeline hardening: log integrity, role-based access, MFA for pipeline admins, alerting on config drift.

Runtime / Production- Verify signed artifacts before deploy; enforce attestation checks (SBOM+signature). - Runtime protection: policy enforcement (Kubernetes admission controllers), EDR, anomaly detection for unexpected outbound connections. - Continuous monitoring for dependency CVEs and automated patching windows.

**Residual risk assessment**- Map threat likelihood × impact per asset; quantify via exposure (internet-facing, criticality), dependency depth, and access scope. - Use periodic tabletop exercises and red-team supply-chain scenarios to validate controls. - Maintain a residual risk register with compensating controls and acceptance authority.

**Vendor attestations & SLAs**- Require vendor-signed attestations: secure development lifecycle, SBOM delivery, vulnerability disclosure timelines, and incident notification within defined RTO/RPO. - Contract clauses: right-to-audit, mandatory use of secure CI practices, cryptographic artifact signing, indemnification for supply-chain incidents. - Enforce technical evidence: periodic third-party pentest reports, SOC2/ISO certification, and automated verification of vendor SBOMs and signatures.

I would operationalize this with detection rules in SIEM for CI anomalies, automated SBOM ingestion, and a vendor risk dashboard showing attestations and residual-risk scores.

HardTechnical

65 practiced

After an incident showed that your organization's threat models missed a critical attack path, describe a structured post-incident process to update threat models, validate the fixes, integrate lessons learned into the SDLC and vulnerability management, and report these updates to leadership and auditors.

Sample Answer

Situation & goalI’d frame this as a structured post-incident program to ensure the missed attack path is closed, validated, embedded in our development lifecycle, and communicated to leadership and auditors.

1) Immediate post-incident triage (24–72 hrs)- Capture forensic artifacts (logs, packet captures, memory) and lock evidence chain.- Document root cause hypothesis and attack path mapped to MITRE ATT&CK.- Short-term mitigations (WAF rule, firewall block, account disable) with owners and deadlines.

2) Formal Post-Incident Review (PIR) — within 7 days- Convene IR, engineering, product, and legal. Produce timeline of events, contributing factors, and decision points.- Update threat model: identify previously-missed trust boundaries, privileges, assumptions (use STRIDE/PASTA).- Produce a Threat Model Change Request (TMCR) listing new threats, risk ratings, required controls, and estimated effort.

3) Implement fixes & validation- Implement fixes as tracked JIRA tickets with severity, owner, and SLA.- Validate via: - Targeted regression tests (unit/integration). - Automated SAST/DAST/SCA scans added to CI. - Focused penetration test or purple-team exercise reproducing the attack path. - SIEM rule tuning and detection playbooks created for indicators of compromise.- Require sign-off from Security and Engineering after acceptance tests.

4) Integrate into SDLC & vulnerability management- Update secure design checklists, threat-model templates, and PR checklist gates to include the new control requirements.- Add new test cases to CI and include threat-model review as a gating step before major releases.- Feed findings into vulnerability management: create recurring scans, asset tagging, and prioritize remediation windows based on new risk scores.

5) Reporting to leadership & auditors- Executive report: succinct timeline, business impact, remediation status, residual risk, and roadmap with completion dates.- Audit package: PIR minutes, TMCR, evidence of fixes (test results, pentest report), updated threat model artifacts, and change-control tickets.- Commit to ongoing metrics: mean time to detect/contain, time to remediate, percentage of services with up-to-date threat models.

Lessons & continuous improvement- Schedule quarterly threat-model reviews, tabletop exercises simulating similar attack paths, and a retro to adjust training and threat intel ingestion.

Why this works- It closes the loop from discovery to verification, institutionalizes the new knowledge into the SDLC and VM program, and provides auditable artifacts and executive visibility.

Unlock Full Question Bank

Get access to hundreds of Threat Modeling and Risk Assessment interview questions and detailed answers.

Join thousands of developers preparing for their dream job.