ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Process for Attack Simulation and Threat Analysis (PASTA) is a seven-stage, risk-centric threat-modeling methodology that begins during the requirements and design phases of the SDLC. It explicitly models attacker behavior, simulates potential attacks against the architecture, and assigns business-driven risk ratings to each identified threat so development teams can prioritize mitigations in future iterations.

STRIDE is primarily a taxonomy for classifying threats but does not prescribe attack simulation or risk ranking. DREAD is only a scoring system for ranking already identified threats and is not, by itself, a complete threat-modeling process. The OWASP Application Security Verification Standard (ASVS) provides security control requirements and verification guidance rather than a methodology for identifying and ranking threats. Therefore, PASTA best meets the project's needs.