Which term best describes a process of understanding threats, determining risks, and establishing mitigations?

• A. Vulnerability Management
• B. Baseline
• C. Centralized Architecture
• D. Threat Modeling

Answer: (D)

Threat modeling is the structured process of identifying security threats to a system, evaluating the risks to its assets, and defining mitigations to reduce those risks. It starts by clarifying what needs protection, who might threaten it, how those threats could exploit weaknesses, and what impact would result. By assessing likelihood and impact, you prioritize risks and decide on controls or design changes to lessen them. The outcome is a set of concrete mitigations integrated into the system’s design and ongoing operations, guiding architecture decisions and security requirements.

This fits best because it explicitly ties understanding threats to assessing risk and selecting mitigations, guiding how a system should be built securely. Vulnerability management concentrates on finding and remediating weaknesses in components after they exist, rather than shaping design through threat and risk analysis. A baseline is about standard configurations, not the process of threat analysis. Centralized architecture describes a structural design choice, not a risk-driven process.