ISC2 Certified Cloud Security Professional (CCSP) Practice Question

In PASTA, Stage 3 is Application Decomposition and Analysis, where the system is broken down into components, data flows, and trust boundaries. The subsequent Stage 4-Threat Analysis-focuses on identifying threat agents, mapping attack vectors to each component, and assigning probability or motivation scores. Stage 5 (Weakness and Vulnerability Analysis) comes later, using the threat inventory to locate exploitable flaws. Stage 6 (Attack Modeling and Simulation) builds attack trees or simulations after vulnerabilities are known, and Stage 2 (Define Technical Scope) should already have been completed before any decomposition work. Therefore, Stage 4 Threat Analysis is the correct next step.