CISSP - Security and Risk Management - Section 1.10

Understand and apply threat modeling concepts and methodologies.

Apply threat modelling methodologies such as STRIDE to systematically enumerate threats against a system by mapping threat actors to the attack surface. Use findings to drive prioritised mitigations, distinguishing between threats that require architectural changes and those addressed by operational controls.

STRIDEthreat modeling methodologiesattack surfacethreat actors

Practice question for this objective

Free sampleSecurity and Risk Managementhard

During architectural review, a team is debating how to reduce attack surface for an internet-facing API gateway. Which statement BEST describes what attack surface reduction means in this context?

ALowering the count of exploitable vulnerabilities currently known in the gateway and its dependent libraries.
BDecreasing the set of reachable entry points, data flows and privileges that an untrusted actor could interact with. Correct
CReplacing perimeter controls with compensating detective controls so that residual exposure becomes monitored.
DLimiting the volume of authenticated requests the gateway will accept from a given client per unit of time.

Define attack surface as the reachable channels, data and privileges exposed to less trusted actors, not the count of known vulnerabilities. Howard and Pincus formalised attack surface as the union of entry and exit points, untrusted data items, and the privileges granted across those interfaces. Reducing it means removing endpoints, narrowing inputs, dropping privileges, and shrinking trust boundaries, all of which lower exposure even when no specific vulnerability is currently known. Patching, monitoring and throttling each address related but distinct concerns.

Why A is wrong: Patching known vulnerabilities reduces exposure but is vulnerability management; attack surface is broader and persists even when no vulnerability is currently known, because it counts reachable channels, data and privileges an attacker could probe.

Why B is correct: Attack surface is the sum of channels (network endpoints, parameters, interfaces), data items, and privileges exposed to a less trusted actor; reducing it means removing or constraining those exposures, which is the architectural goal of the review.

Why C is wrong: Adding detection improves response but leaves the same channels and privileges exposed; monitoring an exposure is not the same as removing it, so by definition it does not reduce attack surface.

Why D is wrong: Rate limiting controls abuse of an exposed channel but the channel, its parameters and its privileges remain present; throttling is an availability and abuse control, not an attack surface reduction.

See more CISSP practice questions, answers explained.

More in this domain

Back to all Security and Risk Management objectives, or the CISSP cert hub.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.