ISC2 CISSP Practice Question

The correct answer is a use case from the point of view of an actor hostile to the system under design.

A misuse case describes how an attacker might attempt to abuse or attack a system. By modeling these malicious scenarios during requirements and design phases, security controls can be developed to counter these potential attacks.

A documented example of how a user might accidentally misuse the system would be more appropriately described as a user error scenario or an exception case, not a misuse case in the security context.

A use case describing how the system should prevent unauthorized access would be a security use case or security requirement, not a misuse case. Misuse cases focus on attack scenarios rather than the protective measures.

A scenario in which the system malfunctions due to programming errors would be a failure scenario or an exception case related to quality assurance, not a misuse case in the security context.