Exam SC-100 topic 4 question 3 discussion

The link provided in the explanation is a nice article but this is a Microsoft exam. The answers must come from Microsoft, using vendor terminology. https://docs.microsoft.com/en-us/learn/modules/tm-create-a-threat-model-using-foundational-data-flow-diagram-elements/1b-elements

For performing threat modeling for an application, especially when using the Microsoft Threat Modeling Tool, you should create: B. Data Flow Diagram (DFD) Data flow diagrams are the primary choice for threat modeling as they help in visualizing how data moves through the system, where it is stored, and how it is processed. This allows you to identify potential security vulnerabilities related to data handling, access points, and data storage. The Microsoft Threat Modeling Tool is particularly geared towards analyzing data flow diagrams to identify potential threats.

https://learn.microsoft.com/en-us/training/modules/tm-introduction-to-threat-modeling/6-summary

@Admin can the answer be adjusted to B please as in the given answer you confirm that it is DFD (Data Flow Diagrams) - "Operational threat models are created from an attacker point of view based on DFDs. "

Clearly B The answer is in the motivation of ExamTopics own answer Reference: https://threatmodeler.com/data-flow-diagrams-process-flow-diagrams/ This is not a microsoft page. Something generic https://docs.microsoft.com/en-us/learn/modules/tm-create-a-threat-model-using-foundational-data-flow-diagram-elements/1b-elements On this Microsoft page it is referred to as Data Flow. And actually using and looking in the TM tool there is no thing as Process Flow or other. There is only "Data Flow" shapes

A. system flow - This is not the typical terminology used in the Microsoft Threat Modeling Tool. B. data flow - Correct Answer. DFDs (data flow diagrams) are commonly used in the Microsoft Threat Modeling Tool to understand how data moves and interacts within a system. C. process flow - Process flow diagrams are more about defining the sequence of processes or activities but don't emphasize on how data moves or is processed. D. network flow - While network flow diagrams are useful for understanding network communication patterns, the Microsoft Threat Modeling Tool emphasizes on data flow diagrams for applications.

When using the Microsoft Threat Modeling Tool, the appropriate type of diagram to create for identifying potential security issues is: B. data flow A data flow diagram (DFD) allows you to visualize how data moves through an application, which is crucial in threat modeling to identify potential vulnerabilities and threats.

B is the answer. https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-getting-started

A data-flow diagram is a way of representing a flow of data through a process or a system (usually an information system). The DFD also provides information about the outputs and inputs of each entity and the process itself. A data-flow diagram has no control flow — there are no decision rules and no loops. Specific operations based on the data can be represented by a flowchart.[1] Data flow diagram with data storage, data flows, function and interface Data flow diagram with data storage, data flows, function and interface

Answer should be "Data Flow" because Threat modelling techniques map the flow of data within your network and the different stages of a prospective cyber attack. The most popular Threat Modelling techniques are Data Flow Diagrams and Attack Trees. Reference: https://www.upguard.com/blog/what-is-threat-modelling#:~:text=The%20most%20popular%20Threat%20Modelling%20techniques%20are%20Data,the%20flow%20of%20data%20through%20an%20organization%27s%20network.

I have downloaded and tried Microsoft Threat Modelling Tool. It can only draw Data Flow Diagram (DFD). Reference Getting started with the Threat Modeling Tool https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-getting-started

Dataflow make sense as it is application/data flow

C: Process Flow is the right answer.

For me the critical difference between the data flow and process flow is that the process flow diagram incorporates developers into the process, and is aimed at developers rather than security professionals. "Which type of diagram should you create? Process flow diagrams are the result of a maturing threat modeling discipline. They genuinely allow incorporation of developers in the threat modeling process during the application design phase"

Data Flow Microsoft Threat Modeling Tool The Microsoft Threat Modeling Tool makes threat modeling easier for all developers through a standard notation for visualizing system components, data flows, and security boundaries. It also helps threat modelers identify classes of threats they should consider based on the structure of their software design. We designed the tool with non-security experts in mind, making threat modeling easier for all developers by providing clear guidance on creating and analyzing threat models.

https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-getting-started

Process flow diagrams (PFDs) These are used by agile teams to build application threat models (ATMs). Agile software development teams can analyse their applications and features by critically examining the communication protocols used to connect the code’s building blocks together.