350-201 Question 170
Select 3A financial institution is building a new online banking platform and has hired a security team to evaluate potential threats. During the threat modeling process, which components must be analyzed to ensure a comprehensive understanding of the system's security posture?
- A
The data flow between different components of the platform
- B
The physical location of the servers hosting the platform
- C
The types of users accessing the platform and their permissions
- D
The known vulnerabilities in third-party software used by the platform
- E
The branding and marketing strategy of the platform
Show answer and explanation
Correct answers: A, C, D
Explanation
Threat modeling involves analyzing components like data flows, user roles and permissions, and third-party dependencies to identify and mitigate potential risks. While factors like physical server location or marketing strategy may be important for other aspects of the business, they do not directly contribute to the understanding of threats in the context of the system's security posture.
- A. Correct.
Correct: Understanding the data flow helps identify where sensitive information is transmitted, processed, or stored, which is critical for identifying potential attack vectors.
- B. Incorrect.
Incorrect: While the physical location of servers may be relevant in certain contexts, such as regulatory compliance, it is not directly part of the threat modeling process focused on identifying threats to the system itself.
- C. Correct.
Correct: Identifying the types of users and their permissions is essential for understanding potential misuse or abuse of the system, such as privilege escalation attacks.
- D. Correct.
Correct: Known vulnerabilities in third-party software are critical to analyze, as they could serve as entry points for attackers targeting the platform.
- E. Incorrect.
Incorrect: The branding and marketing strategy is unrelated to the technical or security components of the system and is not part of the threat modeling process.