ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The technique that explicitly examines spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege is the STRIDE threat-modeling framework. STRIDE guides security practitioners to create data-flow diagrams, define trust boundaries, and systematically identify how each of the six threat classes could exploit the system. A Business Impact Analysis focuses on operational and financial effects of outages rather than enumerating attack vectors. Annualized Loss Expectancy is a quantitative risk calculation that requires threat likelihood and impact values but does not reveal specific technical threats. Populating a risk register records identified risks and treatments, yet it depends on prior discovery work such as threat modeling; it is not itself a technique for uncovering detailed threats. Therefore, using STRIDE is the most appropriate choice in this scenario.