CRISC IT Risk Identification Practice Question
A multinational corporation is developing a new e-commerce platform using microservices architecture. The security team is conducting a threat modeling exercise to identify potential application-level threats. Which TWO threat modeling methodologies are most appropriate for this DevSecOps environment?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
STRIDE
PASTA is a risk-focused threat modeling methodology that aligns with business objectives, and STRIDE is a classic approach for identifying application threats. VAST is tailored for Agile/DevSecOps but is less common; TRIKE is requirements-based but not as widely used for DevSecOps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VAST
Why it's wrong here
VAST is designed for Agile and DevSecOps, but it is less standardized and not as widely recognized for threat modeling in this context.
- ✓
STRIDE
Why this is correct
STRIDE is a threat modeling technique commonly used to identify application threats such as spoofing, tampering, and information disclosure.
- ✗
OWASP Top 10
Why it's wrong here
OWASP Top 10 is a list of common web application vulnerabilities, not a threat modeling methodology.
- ✓
PASTA
Why this is correct
PASTA (Process for Attack Simulation and Threat Analysis) is a risk-centric methodology that aligns technical threats with business impact, suitable for complex applications.
- ✗
TRIKE
Why it's wrong here
TRIKE is a requirements-based model that focuses on risk management but is not typically used for application-level threat modeling in DevSecOps.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.