CCNP Security 300-745 SDSI Practice Test 23

Correct Answer: Common attack patterns describing how adversaries exploit known weaknesses, expressed at a level useful for understanding attacker methodology and technique
Explanation: CAPEC catalogs common attack patterns describing adversary exploitation methodology, unlike a CVE vulnerability catalog, a cloud billing framework, a physical building certification standard, a financial regulatory framework, or a programming style guide.

Correct Answer: Threat modeling, where CAPEC patterns help identify realistic attack methodologies an adversary might use against the specific system architecture being designed
Explanation: Threat modeling directly benefits from CAPEC patterns to identify realistic adversary methodologies against the architecture, unlike calculating SLA uptime, selecting UI color scheme, determining data center square footage, scheduling performance reviews, or selecting documentation fonts, none of which relate to attack pattern analysis.

Correct Answer: Mapping the CAPEC attack patterns most relevant to the application's technology stack and exposure (such as injection or authentication bypass patterns) to specific compensating controls that address those exact attack methodologies
Explanation: Mapping relevant CAPEC patterns to specific compensating controls tailored to the application's stack and exposure is the effective practice, unlike selecting controls randomly, assuming uniform relevance across all applications, relying solely on informal intuition, using one generic control for everything, or only applying CAPEC data post-deployment.

Correct Answer: The team could apply generic, broadly relevant attack pattern mitigations that do not actually match the system's specific exposure, potentially missing context-specific attack paths while over-investing in irrelevant ones
Explanation: Applying CAPEC patterns without system-specific context risks generic mitigations that miss actual exposure while over-investing elsewhere, unlike assuming context-free use guarantees complete protection, that DNS infrastructure fails, that it reduces tooling costs, that it has no impact on accuracy, or that context-free application is more accurate than context-specific use.

Correct Answer: The system's actual technology stack, exposure (such as internet-facing versus internal-only), and the sensitivity of the data or functions it handles, which determine which attack patterns are realistically applicable
Explanation: The system's technology stack, exposure, and data/function sensitivity determine which CAPEC patterns are realistically applicable and thus prioritized, which is unrelated to the documentation template's color scheme, security team's coffee brand, headquarters parking space count, an internal newsletter's font, or outdoor temperature.

Correct Answer: Mapping CAPEC attack patterns to each application's specific technology stack and exposure during threat modeling, selecting compensating controls tailored to the most relevant patterns, and revisiting the mapping as the application's architecture evolves
Explanation: Tailored mapping during threat modeling, pattern-specific control selection, and ongoing revisiting as architecture evolves together provide effective use, unlike applying identical generic controls to every application, referencing CAPEC only at the end of the lifecycle, ignoring CAPEC entirely, never revisiting the mapping, or applying CAPEC only to internet-facing applications.

Correct Answer: Review the original threat modeling process to determine why that CAPEC pattern was not considered despite being well-documented and relevant, and update the threat modeling process to ensure comparable patterns are systematically reviewed for similar future systems
Explanation: Reviewing why the well-documented pattern was missed and updating the threat modeling process for future systems is the appropriate response, unlike blaming desktop wallpaper, discontinuing CAPEC use entirely, wrongly assuming documented patterns are deprecated, blaming unrelated air conditioning, or blaming the phase of the moon.

Correct Answer: CAPEC catalogs attack patterns focused on exploitation methodology (how a weakness is exploited), while ATT&CK catalogs adversary tactics and techniques observed across the broader attack lifecycle, and the two can be used complementarily to inform threat modeling and detection design
Explanation: CAPEC focuses on exploitation methodology while ATT&CK covers broader adversary tactics/techniques, and the two complement each other, unlike claiming they're identical, that either fully replaces the other, that an organization must choose only one, or that they can't be applied to the same system's threat modeling.

Correct Answer: Periodically reviewing updates to the CAPEC catalog for newly documented or refined attack patterns, revisiting existing threat models to incorporate relevant new patterns, and reassessing control mappings as system architectures change
Explanation: Periodic catalog review, revisiting threat models for new patterns, and reassessing control mappings as architecture changes together keep CAPEC use current, unlike a static snapshot never updated, assuming the catalog never changes, decade-only review, ignoring architecture changes, or disabling review once deemed mature.

Correct Answer: Reviewing CAPEC attack patterns associated with the closest analogous technology categories, supplementing that analysis with external expertise or vendor security guidance specific to the emerging technology
Explanation: Reviewing patterns from analogous technology categories and supplementing with external expertise or vendor guidance addresses the unfamiliar stack, unlike assuming no patterns apply to new technology, skipping threat modeling due to limited expertise, assuming patterns apply identically without adaptation, relying solely on vendor marketing, or delaying design consideration until familiarity increases.