Question

A financial services company is building a new customer-facing loan application platform on Azure App Service with an Azure SQL backend. The security architect wants to embed threat modeling into the secure development lifecycle so that architectural design flaws are identified before any code is written. During which activity should the team produce a data flow diagram, enumerate trust boundaries, and systematically classify threats using a structured methodology such as STRIDE?

Accepted Answer

During the design phase, before implementation begins, using STRIDE-based threat modeling against the proposed architecture and its trust boundaries

Answer

During the release phase, by running a dynamic application security test (DAST) scan against the deployed staging environment

Answer

During the verification phase, by performing a manual penetration test after the code is feature-complete

Answer

During the operations phase, by reviewing Microsoft Defender for Cloud attack paths against the production workload