The priority level of attacks based on the MITRE CAPEC model focuses on the:

The correct answer is C. Attack pattern's complexity and risk. MITRE CAPEC (Common Attack Pattern Enumeration and Classification) assigns priority levels to attack patterns based on their complexity (how difficult the attack is to execute) and risk (the potential impact if successful) - making C correct. This dual-factor scoring helps…

Threat Modeling Techniques

Question

Options

AAge of the technology used
BType of data at risk
CAttack pattern's complexity and risk
DGeographic location of the attacker

How the community answered

(24 responses)

A
4% (1)
C
92% (22)
D
4% (1)

Explanation

MITRE CAPEC (Common Attack Pattern Enumeration and Classification) assigns priority levels to attack patterns based on their complexity (how difficult the attack is to execute) and risk (the potential impact if successful) - making C correct. This dual-factor scoring helps security teams prioritize which attack patterns to defend against most urgently.

Why the distractors are wrong:

A (Age of technology): CAPEC does not factor in how old a technology is; a legacy vulnerability can still be low-risk, and a new one can be critical.
B (Type of data at risk): CAPEC classifies attack patterns, not specific data types - data sensitivity is a business context concern, not a CAPEC scoring dimension.
D (Geographic location): Attacker location is irrelevant to CAPEC's classification model; attack patterns are technology- and technique-focused, not geographically scoped.

Memory tip: Think of CAPEC priority as a risk/reward calculator for the attacker - how hard is it to pull off (complexity) vs. how bad is the damage (risk)? If it's easy and devastating, it ranks highest.

Topics

#MITRE CAPEC#Attack patterns#Attack prioritization#Risk assessment

Community Discussion

No community discussion yet for this question.

Full 300-220 Practice