Your company is developing a modern application that will run as an Azure App Service web app. You plan to perform threat modeling to identify potential security issues by using the Microsoft Threat…

The correct answer is A. data flow. The Microsoft Threat Modeling Tool uses Data Flow Diagrams (DFDs) as its foundational diagram type. A DFD maps all entities (external actors, processes, data stores) and the flows of data between them, including trust boundaries. This structure is what STRIDE threat analysis…

Design security solutions for applications and data

Question

Your company is developing a modern application that will run as an Azure App Service web app. You plan to perform threat modeling to identify potential security issues by using the Microsoft Threat Modeling Tool. Which type of diagram should you create?

Options

Adata flow
Bsystem flow
Cprocess flow
Dnetwork flow

How the community answered

(45 responses)

A
93% (42)
B
4% (2)
D
2% (1)

Explanation

The Microsoft Threat Modeling Tool uses Data Flow Diagrams (DFDs) as its foundational diagram type. A DFD maps all entities (external actors, processes, data stores) and the flows of data between them, including trust boundaries. This structure is what STRIDE threat analysis operates on-each element and flow is evaluated for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege threats. For an Azure App Service web app, you would diagram how data flows between the browser, the web app process, any backing APIs or databases, and external services. 'System flow,' 'process flow,' and 'network flow' are not recognized diagram types in the Microsoft Threat Modeling Tool methodology.

Topics

#Threat Modeling#Microsoft Threat Modeling Tool#Data Flow Diagrams#Application Security

Community Discussion

No community discussion yet for this question.

Full SC-100 Practice