Selecting the appropriate threat modeling approach for a scenario requires understanding the:

Question

Options

• AFinancial budget of the organization
• BSpecific security requirements and context
• CNumber of employees in the organization
• DBrand of hardware used in the IT infrastructure

• A
  4% (2)
• B
  87% (45)
• C
  8% (4)
• D
  2% (1)

Explanation

Selecting the right threat modeling approach hinges on understanding the specific security requirements and context (B) because different environments, asset sensitivities, regulatory obligations, and attack surfaces demand tailored methodologies - for example, STRIDE suits software design review while PASTA fits risk-centric business contexts.

Why the distractors fail:

• (A) Financial budget - while budgets influence tooling, they don't determine which threat modeling approach (methodology) fits the scenario.
• (C) Number of employees - organizational size is irrelevant; a two-person startup handling healthcare data needs rigorous threat modeling just as much as a large enterprise.
• (D) Hardware brand - threat modeling is methodology-agnostic with respect to vendor choice; it focuses on identifying threats, not inventory labels.

Memory tip: Think "context is king" - threat modeling approaches (STRIDE, PASTA, OCTAVE, TRIKE, etc.) are frameworks chosen to match what you're protecting and why, not how big your team is or how much money you have.

No community discussion yet for this question.