ISC2 CISSP Practice Question

The correct answer is to systematically identify, prioritize, and address potential security threats early in development because threat modeling is specifically designed to analyze an application's architecture, identify potential threats, assess their likelihood and impact, and implement appropriate mitigations before development progresses too far. This proactive approach helps teams build security in from the beginning rather than trying to add it later.

Identifying attackers and their motivations can be one component of threat modeling, but this answer is too narrow and misses the broader purpose of the process, which includes identifying vulnerabilities, designing countermeasures, and improving the overall security architecture.

Documenting known vulnerabilities in third-party components is part of software composition analysis or dependency scanning, not threat modeling. Threat modeling focuses on the security of the application being designed rather than specifically on third-party components.

Creating incident response plans is important but falls under security operations rather than threat modeling. Threat modeling is performed during design and development phases to prevent security issues, whereas incident response planning prepares for handling security incidents after they occur.