Threat modeling is used to enhance security by which activity?

Threat modeling is used to enhance security by which activity?

• A. Identifying threats and designing mitigations
• B. Auditing vendor contracts
• C. Upgrading hardware on a schedule
• D. Replacing passwords with biometrics policy

Answer: (A)

Threat modeling starts by identifying potential threats to a system and deciding on mitigations to reduce risk. It involves analyzing how the system works—the architecture, data flows, trust boundaries, and who or what might attack it—and then mapping those threats to concrete countermeasures. By understanding where attackers could exploit weaknesses and what impact those exploits would have, you can prioritize protections, design security controls, and plan defense-in-depth before problems occur. That’s why identifying threats and designing mitigations is the best-fitting activity for enhancing security through threat modeling. The other options describe tasks like contract review, hardware maintenance, or policy changes, which address different aspects of risk or operations rather than the proactive threat identification and mitigation planning central to threat modeling.

Threat modeling starts by identifying potential threats to a system and deciding on mitigations to reduce risk. It involves analyzing how the system works—the architecture, data flows, trust boundaries, and who or what might attack it—and then mapping those threats to concrete countermeasures. By understanding where attackers could exploit weaknesses and what impact those exploits would have, you can prioritize protections, design security controls, and plan defense-in-depth before problems occur. That’s why identifying threats and designing mitigations is the best-fitting activity for enhancing security through threat modeling. The other options describe tasks like contract review, hardware maintenance, or policy changes, which address different aspects of risk or operations rather than the proactive threat identification and mitigation planning central to threat modeling.