Threat Modeling Language
Learn threat modeling vocabulary: STRIDE, DREAD, attack trees, threat actors, and communicating security risk.
0 / 45 completed
1 / 45
STRIDE is a threat modeling framework where 'T' stands for:
STRIDE = Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege — a Microsoft framework for categorising security threats.
2 / 45
In threat modeling, a 'threat actor' is:
Threat actors are potential adversaries: nation-state actors, cybercriminals, insiders, script kiddies. Understanding threat actors helps prioritise security controls.
3 / 45
An 'attack surface' refers to:
Attack surface includes all externally accessible interfaces, services, APIs, network ports, and code paths — reducing attack surface is a key security principle.
4 / 45
What does 'defence in depth' mean in security architecture?
Defence in depth uses multiple security layers (perimeter, network, host, application, data) — an attacker must breach all layers, making compromise significantly harder.
5 / 45
In STRIDE, 'Elevation of Privilege' means:
EoP threats involve attackers gaining unauthorised access: a low-privilege user exploiting a bug to gain admin rights, or a web app user accessing another user's data.
6 / 45
Sarah: "Hey team, I've just finished the initial threat model for the new user onboarding flow. It identifies a potential risk – an attacker could inject malicious JavaScript into the input field during registration to steal user credentials. I've marked it as 'T—Tampering' in STRIDE. What would be the most appropriate response from Mark, the senior developer, during a code review?
A. "Sounds good, just make sure the input sanitization is robust." B. "That's a high priority! Can you elaborate on how that tampering could happen and what mitigation strategies we should implement?" C. "Tampering is always a concern; let's focus on reducing the attack surface first." D. "I don't think 'T—Tampering' is the right classification, it's more of an information disclosure risk."
The correct answer (B) demonstrates proactive threat modeling and encourages further investigation. Mark's response highlights the importance of understanding the specific vulnerability – how it could be exploited – and identifying appropriate mitigation steps. Options A and C are too vague and don't address the core issue, while option D mischaracterizes the threat type (Tampering is about modifying data, not simply reducing the attack surface).
7 / 45
Mark: "I've reviewed the threat model and I'm concerned about this 'T—Tampering' risk associated with user registration. While input sanitization is important, it doesn't fully address the potential for an attacker to modify data directly within the database during that process. Considering we're handling sensitive authentication information, how should Sarah best respond to Mark's feedback when discussing this in a PR description update?The key here isn't just acknowledging the risk but demonstrating a clear understanding of *why* it's categorized as 'T—Tampering'. Mark correctly identifies that sanitization alone is insufficient against a determined attacker. Option 1 highlights a common misconception – that simply adding more layers of protection always solves the problem. Option 2 shows the appropriate response: detailing the vulnerability, mitigation strategies (parameterized queries are crucial for this scenario), and demonstrating accountability for addressing the risk effectively. Options 3 and 4 misinterpret the STRIDE classification or offer simplistic solutions.
8 / 45
The key here isn't just about *having* rate limiting, but *how effectively* it's being used and monitored. Option B probes Liam on the crucial aspects of monitoring – anomaly detection, metric tracking – which are essential for understanding if the rate limits are actually preventing abuse. Options A, C, and D all present overly simplistic or potentially harmful assumptions about rate limiting's effectiveness or a premature focus on implementation without proper oversight.
9 / 45
// Code Review Comment
During a code review of the new order processing service, Emily notices that the API endpoint for creating orders doesn't include any rate limiting. The team has discussed threat modeling and understands the importance of considering potential attacks like denial-of-service (DoS). Which of the following comments would be MOST helpful for David, a developer, to add to the code review discussion?
// Code Review CommentThe correct answer highlights the direct link between the threat model and the code. Emily's comment correctly emphasizes the need for input validation, which directly addresses a potential DoS attack identified during threat modeling. Options A and D are too general or misinterpret the role of rate limiting; option B focuses on the immediate technical issue while option C explicitly connects the code to the threat model's findings.
10 / 45
Alex is presenting the threat model for a new e-commerce platform to the team. He's identified a risk: 'T—Threat Agent' could exploit a vulnerability in the product search functionality to inject malicious code into search results, leading users to phishing sites. During the discussion, Ben, a junior developer, suggests simply adding a warning message to the search results page informing users about potential risks. Which of the following responses from Sarah, the team lead, would BEST address Ben's suggestion and demonstrate a deeper understanding of threat modeling principles?
The correct answer (B) forces a deeper investigation into the root cause of the threat – understanding the specific vulnerability being exploited is crucial for effective mitigation. Options A and C are superficial fixes that don't address the underlying security problem. Option D is a valid approach but doesn't directly respond to Ben's immediate suggestion, missing the opportunity to educate him on the core principles of STRIDE.
11 / 45
Sarah: "Hey team, I've just finished the initial threat model for the new user onboarding flow. It identifies a potential risk – an attacker could inject malicious JavaScript into the input field during registration to steal user credentials. I've marked it as 'T—Tampering' in STRIDE. What would be the most appropriate response from Mark, the senior developer, during a code review?
A. "Sounds good, just make sure the input sanitization is robust." B. "That's a high priority! Can you elaborate on how that tampering could happen and what mitigation strategies we should implement?" C. "Tampering is always a concern; let's focus on reducing the attack surface first." D. "I don't think 'T—Tampering' is the right classification, it's more of an information disclosure risk."
The correct answer (B) demonstrates proactive threat modeling and encourages further investigation. Mark's response highlights the importance of understanding the specific vulnerability – how it could be exploited – and identifying appropriate mitigation steps. Options A and C are too vague and don't address the core issue, while option D mischaracterizes the threat type (Tampering is about modifying data, not simply reducing the attack surface).
12 / 45
Mark: "I've reviewed the threat model and I'm concerned about this 'T—Tampering' risk associated with user registration. While input sanitization is important, it doesn't fully address the potential for an attacker to modify data directly within the database during that process. Considering we're handling sensitive authentication information, how should Sarah best respond to Mark's feedback when discussing this in a PR description update?The key here isn't just acknowledging the risk but demonstrating a clear understanding of *why* it's categorized as 'T—Tampering'. Mark correctly identifies that sanitization alone is insufficient against a determined attacker. Option 1 highlights a common misconception – that simply adding more layers of protection always solves the problem. Option 2 shows the appropriate response: detailing the vulnerability, mitigation strategies (parameterized queries are crucial for this scenario), and demonstrating accountability for addressing the risk effectively. Options 3 and 4 misinterpret the STRIDE classification or offer simplistic solutions.
13 / 45
The key here isn't just about *having* rate limiting, but *how effectively* it's being used and monitored. Option B probes Liam on the crucial aspects of monitoring – anomaly detection, metric tracking – which are essential for understanding if the rate limits are actually preventing abuse. Options A, C, and D all present overly simplistic or potentially harmful assumptions about rate limiting's effectiveness or a premature focus on implementation without proper oversight.
14 / 45
// Code Review Comment
During a code review of the new order processing service, Emily notices that the API endpoint for creating orders doesn't include any rate limiting. The team has discussed threat modeling and understands the importance of considering potential attacks like denial-of-service (DoS). Which of the following comments would be MOST helpful for David, a developer, to add to the code review discussion?
// Code Review CommentThe correct answer highlights the direct link between the threat model and the code. Emily's comment correctly emphasizes the need for input validation, which directly addresses a potential DoS attack identified during threat modeling. Options A and D are too general or misinterpret the role of rate limiting; option B focuses on the immediate technical issue while option C explicitly connects the code to the threat model's findings.
15 / 45
Alex is presenting the threat model for a new e-commerce platform to the team. He's identified a risk: 'T—Threat Agent' could exploit a vulnerability in the product search functionality to inject malicious code into search results, leading users to phishing sites. During the discussion, Ben, a junior developer, suggests simply adding a warning message to the search results page informing users about potential risks. Which of the following responses from Sarah, the team lead, would BEST address Ben's suggestion and demonstrate a deeper understanding of threat modeling principles?
The correct answer (B) forces a deeper investigation into the root cause of the threat – understanding the specific vulnerability being exploited is crucial for effective mitigation. Options A and C are superficial fixes that don't address the underlying security problem. Option D is a valid approach but doesn't directly respond to Ben's immediate suggestion, missing the opportunity to educate him on the core principles of STRIDE.
16 / 45
Sarah: "Hey team, I've just finished the initial threat model for the new user onboarding flow. It identifies a potential risk – an attacker could inject malicious JavaScript into the input field during registration to steal user credentials. I've marked it as 'T—Tampering' in STRIDE. What would be the most appropriate response from Mark, the senior developer, during a code review?
A. "Sounds good, just make sure the input sanitization is robust." B. "That's a high priority! Can you elaborate on how that tampering could happen and what mitigation strategies we should implement?" C. "Tampering is always a concern; let's focus on reducing the attack surface first." D. "I don't think 'T—Tampering' is the right classification, it's more of an information disclosure risk."
The correct answer (B) demonstrates proactive threat modeling and encourages further investigation. Mark's response highlights the importance of understanding the specific vulnerability – how it could be exploited – and identifying appropriate mitigation steps. Options A and C are too vague and don't address the core issue, while option D mischaracterizes the threat type (Tampering is about modifying data, not simply reducing the attack surface).
17 / 45
Mark: "I've reviewed the threat model and I'm concerned about this 'T—Tampering' risk associated with user registration. While input sanitization is important, it doesn't fully address the potential for an attacker to modify data directly within the database during that process. Considering we're handling sensitive authentication information, how should Sarah best respond to Mark's feedback when discussing this in a PR description update?The key here isn't just acknowledging the risk but demonstrating a clear understanding of *why* it's categorized as 'T—Tampering'. Mark correctly identifies that sanitization alone is insufficient against a determined attacker. Option 1 highlights a common misconception – that simply adding more layers of protection always solves the problem. Option 2 shows the appropriate response: detailing the vulnerability, mitigation strategies (parameterized queries are crucial for this scenario), and demonstrating accountability for addressing the risk effectively. Options 3 and 4 misinterpret the STRIDE classification or offer simplistic solutions.
18 / 45
The key here isn't just about *having* rate limiting, but *how effectively* it's being used and monitored. Option B probes Liam on the crucial aspects of monitoring – anomaly detection, metric tracking – which are essential for understanding if the rate limits are actually preventing abuse. Options A, C, and D all present overly simplistic or potentially harmful assumptions about rate limiting's effectiveness or a premature focus on implementation without proper oversight.
19 / 45
// Code Review Comment
During a code review of the new order processing service, Emily notices that the API endpoint for creating orders doesn't include any rate limiting. The team has discussed threat modeling and understands the importance of considering potential attacks like denial-of-service (DoS). Which of the following comments would be MOST helpful for David, a developer, to add to the code review discussion?
// Code Review CommentThe correct answer highlights the direct link between the threat model and the code. Emily's comment correctly emphasizes the need for input validation, which directly addresses a potential DoS attack identified during threat modeling. Options A and D are too general or misinterpret the role of rate limiting; option B focuses on the immediate technical issue while option C explicitly connects the code to the threat model's findings.
20 / 45
Alex is presenting the threat model for a new e-commerce platform to the team. He's identified a risk: 'T—Threat Agent' could exploit a vulnerability in the product search functionality to inject malicious code into search results, leading users to phishing sites. During the discussion, Ben, a junior developer, suggests simply adding a warning message to the search results page informing users about potential risks. Which of the following responses from Sarah, the team lead, would BEST address Ben's suggestion and demonstrate a deeper understanding of threat modeling principles?
The correct answer (B) forces a deeper investigation into the root cause of the threat – understanding the specific vulnerability being exploited is crucial for effective mitigation. Options A and C are superficial fixes that don't address the underlying security problem. Option D is a valid approach but doesn't directly respond to Ben's immediate suggestion, missing the opportunity to educate him on the core principles of STRIDE.
21 / 45
Sarah: "Hey team, I've just finished the initial threat model for the new user onboarding flow. It identifies a potential risk – an attacker could inject malicious JavaScript into the input field during registration to steal user credentials. I've marked it as 'T—Tampering' in STRIDE. What would be the most appropriate response from Mark, the senior developer, during a code review?
A. "Sounds good, just make sure the input sanitization is robust." B. "That's a high priority! Can you elaborate on how that tampering could happen and what mitigation strategies we should implement?" C. "Tampering is always a concern; let's focus on reducing the attack surface first." D. "I don't think 'T—Tampering' is the right classification, it's more of an information disclosure risk."
The correct answer (B) demonstrates proactive threat modeling and encourages further investigation. Mark's response highlights the importance of understanding the specific vulnerability – how it could be exploited – and identifying appropriate mitigation steps. Options A and C are too vague and don't address the core issue, while option D mischaracterizes the threat type (Tampering is about modifying data, not simply reducing the attack surface).
22 / 45
Mark: "I've reviewed the threat model and I'm concerned about this 'T—Tampering' risk associated with user registration. While input sanitization is important, it doesn't fully address the potential for an attacker to modify data directly within the database during that process. Considering we're handling sensitive authentication information, how should Sarah best respond to Mark's feedback when discussing this in a PR description update?The key here isn't just acknowledging the risk but demonstrating a clear understanding of *why* it's categorized as 'T—Tampering'. Mark correctly identifies that sanitization alone is insufficient against a determined attacker. Option 1 highlights a common misconception – that simply adding more layers of protection always solves the problem. Option 2 shows the appropriate response: detailing the vulnerability, mitigation strategies (parameterized queries are crucial for this scenario), and demonstrating accountability for addressing the risk effectively. Options 3 and 4 misinterpret the STRIDE classification or offer simplistic solutions.
23 / 45
The key here isn't just about *having* rate limiting, but *how effectively* it's being used and monitored. Option B probes Liam on the crucial aspects of monitoring – anomaly detection, metric tracking – which are essential for understanding if the rate limits are actually preventing abuse. Options A, C, and D all present overly simplistic or potentially harmful assumptions about rate limiting's effectiveness or a premature focus on implementation without proper oversight.
24 / 45
// Code Review Comment
During a code review of the new order processing service, Emily notices that the API endpoint for creating orders doesn't include any rate limiting. The team has discussed threat modeling and understands the importance of considering potential attacks like denial-of-service (DoS). Which of the following comments would be MOST helpful for David, a developer, to add to the code review discussion?
// Code Review CommentThe correct answer highlights the direct link between the threat model and the code. Emily's comment correctly emphasizes the need for input validation, which directly addresses a potential DoS attack identified during threat modeling. Options A and D are too general or misinterpret the role of rate limiting; option B focuses on the immediate technical issue while option C explicitly connects the code to the threat model's findings.
25 / 45
Alex is presenting the threat model for a new e-commerce platform to the team. He's identified a risk: 'T—Threat Agent' could exploit a vulnerability in the product search functionality to inject malicious code into search results, leading users to phishing sites. During the discussion, Ben, a junior developer, suggests simply adding a warning message to the search results page informing users about potential risks. Which of the following responses from Sarah, the team lead, would BEST address Ben's suggestion and demonstrate a deeper understanding of threat modeling principles?
The correct answer (B) forces a deeper investigation into the root cause of the threat – understanding the specific vulnerability being exploited is crucial for effective mitigation. Options A and C are superficial fixes that don't address the underlying security problem. Option D is a valid approach but doesn't directly respond to Ben's immediate suggestion, missing the opportunity to educate him on the core principles of STRIDE.
26 / 45
Sarah: "Hey team, I've just finished the initial threat model for the new user onboarding flow. It identifies a potential risk – an attacker could inject malicious JavaScript into the input field during registration to steal user credentials. I've marked it as 'T—Tampering' in STRIDE. What would be the most appropriate response from Mark, the senior developer, during a code review?
A. "Sounds good, just make sure the input sanitization is robust." B. "That's a high priority! Can you elaborate on how that tampering could happen and what mitigation strategies we should implement?" C. "Tampering is always a concern; let's focus on reducing the attack surface first." D. "I don't think 'T—Tampering' is the right classification, it's more of an information disclosure risk."
The correct answer (B) demonstrates proactive threat modeling and encourages further investigation. Mark's response highlights the importance of understanding the specific vulnerability – how it could be exploited – and identifying appropriate mitigation steps. Options A and C are too vague and don't address the core issue, while option D mischaracterizes the threat type (Tampering is about modifying data, not simply reducing the attack surface).
27 / 45
Mark: "I've reviewed the threat model and I'm concerned about this 'T—Tampering' risk associated with user registration. While input sanitization is important, it doesn't fully address the potential for an attacker to modify data directly within the database during that process. Considering we're handling sensitive authentication information, how should Sarah best respond to Mark's feedback when discussing this in a PR description update?The key here isn't just acknowledging the risk but demonstrating a clear understanding of *why* it's categorized as 'T—Tampering'. Mark correctly identifies that sanitization alone is insufficient against a determined attacker. Option 1 highlights a common misconception – that simply adding more layers of protection always solves the problem. Option 2 shows the appropriate response: detailing the vulnerability, mitigation strategies (parameterized queries are crucial for this scenario), and demonstrating accountability for addressing the risk effectively. Options 3 and 4 misinterpret the STRIDE classification or offer simplistic solutions.
28 / 45
The key here isn't just about *having* rate limiting, but *how effectively* it's being used and monitored. Option B probes Liam on the crucial aspects of monitoring – anomaly detection, metric tracking – which are essential for understanding if the rate limits are actually preventing abuse. Options A, C, and D all present overly simplistic or potentially harmful assumptions about rate limiting's effectiveness or a premature focus on implementation without proper oversight.
29 / 45
// Code Review Comment
During a code review of the new order processing service, Emily notices that the API endpoint for creating orders doesn't include any rate limiting. The team has discussed threat modeling and understands the importance of considering potential attacks like denial-of-service (DoS). Which of the following comments would be MOST helpful for David, a developer, to add to the code review discussion?
// Code Review CommentThe correct answer highlights the direct link between the threat model and the code. Emily's comment correctly emphasizes the need for input validation, which directly addresses a potential DoS attack identified during threat modeling. Options A and D are too general or misinterpret the role of rate limiting; option B focuses on the immediate technical issue while option C explicitly connects the code to the threat model's findings.
30 / 45
Alex is presenting the threat model for a new e-commerce platform to the team. He's identified a risk: 'T—Threat Agent' could exploit a vulnerability in the product search functionality to inject malicious code into search results, leading users to phishing sites. During the discussion, Ben, a junior developer, suggests simply adding a warning message to the search results page informing users about potential risks. Which of the following responses from Sarah, the team lead, would BEST address Ben's suggestion and demonstrate a deeper understanding of threat modeling principles?
The correct answer (B) forces a deeper investigation into the root cause of the threat – understanding the specific vulnerability being exploited is crucial for effective mitigation. Options A and C are superficial fixes that don't address the underlying security problem. Option D is a valid approach but doesn't directly respond to Ben's immediate suggestion, missing the opportunity to educate him on the core principles of STRIDE.
31 / 45
Sarah: "Hey team, I've just finished the initial threat model for the new user onboarding flow. It identifies a potential risk – an attacker could inject malicious JavaScript into the input field during registration to steal user credentials. I've marked it as 'T—Tampering' in STRIDE. What would be the most appropriate response from Mark, the senior developer, during a code review?
A. "Sounds good, just make sure the input sanitization is robust." B. "That's a high priority! Can you elaborate on how that tampering could happen and what mitigation strategies we should implement?" C. "Tampering is always a concern; let's focus on reducing the attack surface first." D. "I don't think 'T—Tampering' is the right classification, it's more of an information disclosure risk."
The correct answer (B) demonstrates proactive threat modeling and encourages further investigation. Mark's response highlights the importance of understanding the specific vulnerability – how it could be exploited – and identifying appropriate mitigation steps. Options A and C are too vague and don't address the core issue, while option D mischaracterizes the threat type (Tampering is about modifying data, not simply reducing the attack surface).
32 / 45
Mark: "I've reviewed the threat model and I'm concerned about this 'T—Tampering' risk associated with user registration. While input sanitization is important, it doesn't fully address the potential for an attacker to modify data directly within the database during that process. Considering we're handling sensitive authentication information, how should Sarah best respond to Mark's feedback when discussing this in a PR description update?The key here isn't just acknowledging the risk but demonstrating a clear understanding of *why* it's categorized as 'T—Tampering'. Mark correctly identifies that sanitization alone is insufficient against a determined attacker. Option 1 highlights a common misconception – that simply adding more layers of protection always solves the problem. Option 2 shows the appropriate response: detailing the vulnerability, mitigation strategies (parameterized queries are crucial for this scenario), and demonstrating accountability for addressing the risk effectively. Options 3 and 4 misinterpret the STRIDE classification or offer simplistic solutions.
33 / 45
The key here isn't just about *having* rate limiting, but *how effectively* it's being used and monitored. Option B probes Liam on the crucial aspects of monitoring – anomaly detection, metric tracking – which are essential for understanding if the rate limits are actually preventing abuse. Options A, C, and D all present overly simplistic or potentially harmful assumptions about rate limiting's effectiveness or a premature focus on implementation without proper oversight.
34 / 45
// Code Review Comment
During a code review of the new order processing service, Emily notices that the API endpoint for creating orders doesn't include any rate limiting. The team has discussed threat modeling and understands the importance of considering potential attacks like denial-of-service (DoS). Which of the following comments would be MOST helpful for David, a developer, to add to the code review discussion?
// Code Review CommentThe correct answer highlights the direct link between the threat model and the code. Emily's comment correctly emphasizes the need for input validation, which directly addresses a potential DoS attack identified during threat modeling. Options A and D are too general or misinterpret the role of rate limiting; option B focuses on the immediate technical issue while option C explicitly connects the code to the threat model's findings.
35 / 45
Alex is presenting the threat model for a new e-commerce platform to the team. He's identified a risk: 'T—Threat Agent' could exploit a vulnerability in the product search functionality to inject malicious code into search results, leading users to phishing sites. During the discussion, Ben, a junior developer, suggests simply adding a warning message to the search results page informing users about potential risks. Which of the following responses from Sarah, the team lead, would BEST address Ben's suggestion and demonstrate a deeper understanding of threat modeling principles?
The correct answer (B) forces a deeper investigation into the root cause of the threat – understanding the specific vulnerability being exploited is crucial for effective mitigation. Options A and C are superficial fixes that don't address the underlying security problem. Option D is a valid approach but doesn't directly respond to Ben's immediate suggestion, missing the opportunity to educate him on the core principles of STRIDE.
36 / 45
Sarah: "Hey team, I've just finished the initial threat model for the new user onboarding flow. It identifies a potential risk – an attacker could inject malicious JavaScript into the input field during registration to steal user credentials. I've marked it as 'T—Tampering' in STRIDE. What would be the most appropriate response from Mark, the senior developer, during a code review?
A. "Sounds good, just make sure the input sanitization is robust." B. "That's a high priority! Can you elaborate on how that tampering could happen and what mitigation strategies we should implement?" C. "Tampering is always a concern; let's focus on reducing the attack surface first." D. "I don't think 'T—Tampering' is the right classification, it's more of an information disclosure risk."
The correct answer (B) demonstrates proactive threat modeling and encourages further investigation. Mark's response highlights the importance of understanding the specific vulnerability – how it could be exploited – and identifying appropriate mitigation steps. Options A and C are too vague and don't address the core issue, while option D mischaracterizes the threat type (Tampering is about modifying data, not simply reducing the attack surface).
37 / 45
Mark: "I've reviewed the threat model and I'm concerned about this 'T—Tampering' risk associated with user registration. While input sanitization is important, it doesn't fully address the potential for an attacker to modify data directly within the database during that process. Considering we're handling sensitive authentication information, how should Sarah best respond to Mark's feedback when discussing this in a PR description update?The key here isn't just acknowledging the risk but demonstrating a clear understanding of *why* it's categorized as 'T—Tampering'. Mark correctly identifies that sanitization alone is insufficient against a determined attacker. Option 1 highlights a common misconception – that simply adding more layers of protection always solves the problem. Option 2 shows the appropriate response: detailing the vulnerability, mitigation strategies (parameterized queries are crucial for this scenario), and demonstrating accountability for addressing the risk effectively. Options 3 and 4 misinterpret the STRIDE classification or offer simplistic solutions.
38 / 45
The key here isn't just about *having* rate limiting, but *how effectively* it's being used and monitored. Option B probes Liam on the crucial aspects of monitoring – anomaly detection, metric tracking – which are essential for understanding if the rate limits are actually preventing abuse. Options A, C, and D all present overly simplistic or potentially harmful assumptions about rate limiting's effectiveness or a premature focus on implementation without proper oversight.
39 / 45
// Code Review Comment
During a code review of the new order processing service, Emily notices that the API endpoint for creating orders doesn't include any rate limiting. The team has discussed threat modeling and understands the importance of considering potential attacks like denial-of-service (DoS). Which of the following comments would be MOST helpful for David, a developer, to add to the code review discussion?
// Code Review CommentThe correct answer highlights the direct link between the threat model and the code. Emily's comment correctly emphasizes the need for input validation, which directly addresses a potential DoS attack identified during threat modeling. Options A and D are too general or misinterpret the role of rate limiting; option B focuses on the immediate technical issue while option C explicitly connects the code to the threat model's findings.
40 / 45
Alex is presenting the threat model for a new e-commerce platform to the team. He's identified a risk: 'T—Threat Agent' could exploit a vulnerability in the product search functionality to inject malicious code into search results, leading users to phishing sites. During the discussion, Ben, a junior developer, suggests simply adding a warning message to the search results page informing users about potential risks. Which of the following responses from Sarah, the team lead, would BEST address Ben's suggestion and demonstrate a deeper understanding of threat modeling principles?
The correct answer (B) forces a deeper investigation into the root cause of the threat – understanding the specific vulnerability being exploited is crucial for effective mitigation. Options A and C are superficial fixes that don't address the underlying security problem. Option D is a valid approach but doesn't directly respond to Ben's immediate suggestion, missing the opportunity to educate him on the core principles of STRIDE.
41 / 45
Sarah: "Hey team, I've just finished the initial threat model for the new user onboarding flow. It identifies a potential risk – an attacker could inject malicious JavaScript into the input field during registration to steal user credentials. I've marked it as 'T—Tampering' in STRIDE. What would be the most appropriate response from Mark, the senior developer, during a code review?
A. "Sounds good, just make sure the input sanitization is robust." B. "That's a high priority! Can you elaborate on how that tampering could happen and what mitigation strategies we should implement?" C. "Tampering is always a concern; let's focus on reducing the attack surface first." D. "I don't think 'T—Tampering' is the right classification, it's more of an information disclosure risk."
The correct answer (B) demonstrates proactive threat modeling and encourages further investigation. Mark's response highlights the importance of understanding the specific vulnerability – how it could be exploited – and identifying appropriate mitigation steps. Options A and C are too vague and don't address the core issue, while option D mischaracterizes the threat type (Tampering is about modifying data, not simply reducing the attack surface).
42 / 45
Mark: "I've reviewed the threat model and I'm concerned about this 'T—Tampering' risk associated with user registration. While input sanitization is important, it doesn't fully address the potential for an attacker to modify data directly within the database during that process. Considering we're handling sensitive authentication information, how should Sarah best respond to Mark's feedback when discussing this in a PR description update?The key here isn't just acknowledging the risk but demonstrating a clear understanding of *why* it's categorized as 'T—Tampering'. Mark correctly identifies that sanitization alone is insufficient against a determined attacker. Option 1 highlights a common misconception – that simply adding more layers of protection always solves the problem. Option 2 shows the appropriate response: detailing the vulnerability, mitigation strategies (parameterized queries are crucial for this scenario), and demonstrating accountability for addressing the risk effectively. Options 3 and 4 misinterpret the STRIDE classification or offer simplistic solutions.
43 / 45
The key here isn't just about *having* rate limiting, but *how effectively* it's being used and monitored. Option B probes Liam on the crucial aspects of monitoring – anomaly detection, metric tracking – which are essential for understanding if the rate limits are actually preventing abuse. Options A, C, and D all present overly simplistic or potentially harmful assumptions about rate limiting's effectiveness or a premature focus on implementation without proper oversight.
44 / 45
// Code Review Comment
During a code review of the new order processing service, Emily notices that the API endpoint for creating orders doesn't include any rate limiting. The team has discussed threat modeling and understands the importance of considering potential attacks like denial-of-service (DoS). Which of the following comments would be MOST helpful for David, a developer, to add to the code review discussion?
// Code Review CommentThe correct answer highlights the direct link between the threat model and the code. Emily's comment correctly emphasizes the need for input validation, which directly addresses a potential DoS attack identified during threat modeling. Options A and D are too general or misinterpret the role of rate limiting; option B focuses on the immediate technical issue while option C explicitly connects the code to the threat model's findings.
45 / 45
Alex is presenting the threat model for a new e-commerce platform to the team. He's identified a risk: 'T—Threat Agent' could exploit a vulnerability in the product search functionality to inject malicious code into search results, leading users to phishing sites. During the discussion, Ben, a junior developer, suggests simply adding a warning message to the search results page informing users about potential risks. Which of the following responses from Sarah, the team lead, would BEST address Ben's suggestion and demonstrate a deeper understanding of threat modeling principles?
The correct answer (B) forces a deeper investigation into the root cause of the threat – understanding the specific vulnerability being exploited is crucial for effective mitigation. Options A and C are superficial fixes that don't address the underlying security problem. Option D is a valid approach but doesn't directly respond to Ben's immediate suggestion, missing the opportunity to educate him on the core principles of STRIDE.
Frequently Asked Questions
What does the "Threat Modeling Language" exercise practise?
Learn threat modeling vocabulary: STRIDE, DREAD, attack trees, threat actors, and communicating security risk.
How many questions are in this exercise?
This exercise has 45 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Cybersecurity category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "Threat Modeling Language" part of a larger series?
Yes — it's one exercise in the Cybersecurity category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Cybersecurity category page for related exercises, or browse the main Exercises hub for other IT English topics.