ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

The Process for Attack Simulation and Threat Analysis (PASTA) is a seven-stage, risk-centric threat-modeling methodology. It begins by identifying business objectives and technical scope, then models and simulates plausible attacks to estimate risk, and finally maps security controls to the most significant threats. STRIDE is category-based and asset-centric, CVSS scores known vulnerabilities rather than modeling threats, and Security Content Automation Protocol (SCAP) is a standards framework for automating vulnerability management-not a threat-modeling process.