VAPT Threat Modeling Interview Questions with Answers and a Practice Exercise

Key takeaways

• STRIDE covers spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.
• Most threats sit where data crosses a trust boundary.
• DREAD is often criticised as subjective, so know alternatives like PASTA.
• Practise by modelling a simple login app on paper.

What interviewers want to hear

Threat modelling is a structured way to ask four questions about a system: what are we building, what can go wrong, what will we do about it, and did we do a good enough job. In a VAPT interview, your answers show whether you can think like an attacker while advising like a defender. Be ready to explain method as well as vocabulary.

Questions with answers

1. What is threat modelling and when is it done?

It is a systematic way to identify assets, entry points and threats, and to choose mitigations. It is best done early in design, and repeated when the architecture changes. For VAPT, it also helps decide what to test first.

2. What does STRIDE stand for?

Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. Each maps to a security property: authentication, integrity, non-repudiation, confidentiality, availability and authorisation.

3. What is a data flow diagram and why use it?

A data flow diagram shows external entities, processes, data stores and the flows between them. You apply STRIDE to each element and flow, so nothing is missed.

4. What is a trust boundary?

It is a line where the level of trust changes, such as between the internet and a web server, or between an application and its database. Most threats sit where data crosses a trust boundary.

5. How do STRIDE, DREAD and PASTA differ?

STRIDE categorises threats. DREAD was a scoring scheme that many teams dropped because its scores were subjective. PASTA is a seven-stage, risk-centric process that starts from business objectives. Attack trees are another option.

6. How do you prioritise threats?

By likelihood and impact, using the organisation's risk method, such as a simple high, medium and low matrix or CVSS for vulnerabilities. Explain your reasoning, since interviewers care about it more than the scale.

7. How does threat modelling help a penetration tester?

It gives a map of likely weak points, such as an unauthenticated admin interface or a service that trusts user input. Testing then targets the highest-risk flows and the findings tie back to named threats.

8. Name tools used for threat modelling.

Examples are OWASP Threat Dragon, the Microsoft Threat Modeling Tool and plain whiteboards or diagrams. Tool choice matters less than the discipline of doing it.

An exercise: model a simple web app

Take a basic login and notes application: a browser, a web server, an API and a database. Try this yourself on paper.

1. Draw the four elements and the flows between them. Mark a trust boundary between the browser and the server, and another between the API and the database.
2. Apply STRIDE to each flow. For the login flow: spoofing (credential stuffing), tampering (modified requests), information disclosure (verbose errors), denial of service (login flooding), elevation of privilege (changing a user ID to see another's notes).
3. Write one mitigation per threat, for example rate limiting, server-side validation, generic error messages and object-level authorisation checks.
4. Choose the three threats you would test first and say why.

The method is described in the OWASP threat modelling page and the OWASP Threat Modeling Cheat Sheet.

Next steps

Read what threat modelling is and how it works, then practise risk management questions and advanced VAPT interview questions. Structured training is in the VAPT course.