Question 1.

The STRIDE threat model is a threat classification system developed by Microsoft that is a useful way of categorizing attacks that arise from deliberate actions. Which one is NOT in the model?

1. Spoofing identity

2. Tampering with data

3. Repudiation

4. Information disclosure

5. Denial of service

6. Elevation of privilege

7. Evaluation

Question 2.

Steps in kill chain (i.e., steps that an adversary uses to target and engage cyberattack to achieve his or her objective) are 1) __________, 2) __________, 3) __________, 4) __________, 5) __________, 6) __________, and 7) __________.

	Reconnaissance; Weaponization; Delivery; Exploit; Installation; Command and control; Actions
	Reconnaissance; Evaluation; Delivery; Exploit; Installation; Command and control; Actions
	Reconnaissance; Weaponization; Exploit; Installation; Delivery; Command and control; Actions
	Reconnaissance; Delivery; Exploit; Installation; Command and control; Actions; Evaluation
	Reconnaissance; Weaponization; Delivery; Exploit; Command and control; Installation; Actions

Question 3.

Once the risk assessment process is complete, management should have a list of all the threats posed to all assets, with an estimate of the magnitude of each risk. The response to the set of identified risks is referred to as risk treatment (or risk response). What are FOUR options for treating risks (or responding to risks)?

	Risk evaluation
	Risk reduction or mitigation
	Risk retention
	Risk allocation
	Risk avoidance
	Risk transfer or sharing