Exam CISSP topic 1 question 218 discussion

Actual exam question from ISC's CISSP

Question #: 218
Topic #: 1

A financial services organization has employed a security consultant to review processes used by employees across various teams. The consultant interviewed a member of the application development practice and found gaps in their threat model. Which of the following correctly represents a trigger for when a threat model should be revised?

A. After operating system (OS) patches are applied
B. A new developer is hired into the team.
C. After a modification to the firewall rule policy
D. A new data repository is added.

Show Suggested Answer

Suggested Answer: D 🗳️

by Rollizo at Oct. 2, 2022, 9:35 a.m.

Comments

Submit Cancel

74gjd_37

9 months, 2 weeks ago

Selected Answer: D

The correct answer is D. While the other factors (A, B, C) can impact the security of a system, they may not necessarily require a revision of the threat model unless they introduce new potential threats that were not previously considered. The addition of a new data repository, on the other hand, can change the threat landscape of the system and introduce new potential threats that were not previously considered, making it a more likely trigger for revising the threat model.

upvoted 4 times

...