Question

A development team is building a new microservices-based cloud application. During the secure SDLC design phase, the security architect wants to systematically identify threats by examining each data flow across trust boundaries between services, the API gateway, and backend datastores. Which approach best fits this requirement?

Accepted Answer

Perform threat modeling using STRIDE against data flow diagrams that map trust boundaries between components

Answer

Run a dynamic application security testing (DAST) scan against the deployed staging environment

Answer

Conduct a penetration test after the application is released to production

Answer

Enable runtime application self-protection (RASP) agents on each microservice container