350-201 Question 172
Select 4You are a cybersecurity analyst tasked with reviewing a threat model for a financial application. During the review, you identify the following components: sensitive customer data stored in a database, an API that handles data transfers, a web portal for customers, and an integration with a third-party payment processor. Which components should be considered as potential attack surfaces in the threat model?
- A
The database storing sensitive customer data
- B
The API that handles data transfers
- C
The internal server hosting the company's employee portal
- D
The web portal used by customers
- E
The integration with the third-party payment processor
Show answer and explanation
Correct answers: A, B, D, E
Explanation
In a threat model, attack surfaces are components or entry points that could be exploited by malicious actors. For the financial application, components like the database, API, web portal, and third-party payment integration are directly involved in handling sensitive data or transactions and thus represent potential attack surfaces. The internal server hosting the employee portal is not relevant to this specific application, so it is excluded from the threat model for this scenario.
- A. Correct.
The database storing sensitive customer data is a critical component in the threat model, as it contains information that attackers may target.
- B. Correct.
The API that handles data transfers is an attack surface since APIs are commonly exploited to manipulate data or gain unauthorized access.
- C. Incorrect.
The internal server hosting the company's employee portal is not relevant here as it is unrelated to the financial application under review.
- D. Correct.
The web portal used by customers is an attack surface because attackers may exploit vulnerabilities in the web interface to compromise data or system security.
- E. Correct.
The integration with the third-party payment processor is a potential attack surface as attackers could exploit it to intercept or manipulate payment transactions.