What Identifies the Attack Surface of a New Environment?
Short answer
B Threat modeling within the SDLC design phase maps data flows, trust boundaries, and exposed services to identify the new environment's attack surface.
Question
Key Takeaways
The exam tests whether you can distinguish lifecycle design activities that expose attack surface from models that describe attacker phases or incident handling; the trap is choosing the Cyber Kill Chain because it sounds security-focused.
Threat modeling during the SDLC design phase identifies a new environment’s attack surface by mapping data flows, trust boundaries, and exposed services. This page explains why the SDLC is the correct choice and why the OSI model, Cyber Kill Chain, and incident response process are not.
Common mistake: A frequent mistake is selecting the Cyber Kill Chain because it enumerates attacker stages; it describes adversary progression, not the entry points and exposed services of a new environment.
Expert Analysis
Why the Answer Is Correct
Threat modeling in the SDLC design phase is the activity that deliberately maps the new environment's data flows, trust boundaries, entry points, open ports, and exposed services before deployment. That mapping is what defines the attack surface area. Because the SDLC covers requirements, design, implementation, and testing, it provides the earliest and most reliable point to identify and reduce that surface. As effa952 noted, "threat modeling maps out data flows, trust boundaries, and open ports" for the new environment. This makes B the best answer.
Why the Other Options Are Wrong
The incident response process is reactive: it handles incidents after they occur, so it does not enumerate a newly designed environment's attack surface. The OSI model is a conceptual framework for network communication layers; it can help organize controls, but it does not identify an environment's exposed assets. The Cyber Kill Chain describes phases of an adversary's intrusion and supports detection and hunting, not design-time attack-surface mapping. None of these three provides the data-flow and trust-boundary analysis associated with the SDLC.
Community Comment Notes
The only substantive comment, from effa952, argues that the SDLC design phase uses threat modeling to map data flows, trust boundaries, and open ports, and that none of the other options really map out an attack surface. That reasoning aligns with the design-time attack-surface analysis the question is asking about. No vote distribution was provided, so the conclusion rests on the question wording and security lifecycle doctrine rather than popularity.
Official Reference
- https://owasp.org/www-community/Threat_Modeling
- https://www.comptia.org/certifications/cybersecurity-analyst
These links open the official vendor documentation in a new tab.
Exam Strategy
When a question mentions a "new environment," look for a design, build, or lifecycle activity rather than a detection or response model. Tie attack-surface identification to threat modeling inside the SDLC, and eliminate options that describe incident handling or attacker phases.
Frequently Asked Questions
Why is the Cyber Kill Chain not the right answer for attack-surface identification?
Where in the SDLC is a new environment's attack surface usually identified?
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
agfencer 👍 1 Answered CC - OSI model isn't just a conceptual chart about network traffic, its a structured methodology for threat modeling. It ensures an analyst looks at everything an attacker could interact with from the physical hardware cables up to the web application software code.
-
effa952 👍 1 Answered BCorrect me if I'm wrong, but during the design phase of the SDLC, threat modeling maps out data flows, trust boundaries, and open ports for the new environment. And none of the other options really map out an attack surface.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.