What Identifies the Attack Surface of a New Environment?
Which of the following helps identify the attack surface area of a new environment?
Community Insight
The exam tests whether you can distinguish lifecycle design activities that expose attack surface from models that describe attacker phases or incident handling; the trap is choosing the Cyber Kill Chain because it sounds security-focused.
Threat modeling during the SDLC design phase identifies a new environment’s attack surface by mapping data flows, trust boundaries, and exposed services. This page explains why the SDLC is the correct choice and why the OSI model, Cyber Kill Chain, and incident response process are not.
A frequent mistake is selecting the Cyber Kill Chain because it enumerates attacker stages; it describes adversary progression, not the entry points and exposed services of a new environment.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Threat modeling in the SDLC design phase is the activity that deliberately maps the new environment's data flows, trust boundaries, entry points, open ports, and exposed services before deployment. That mapping is what defines the attack surface area. Because the SDLC covers requirements, design, implementation, and testing, it provides the earliest and most reliable point to identify and reduce that surface. As effa952 noted, "threat modeling maps out data flows, trust boundaries, and open ports" for the new environment. This makes B the best answer.Why the Other Options Are Wrong
The incident response process is reactive: it handles incidents after they occur, so it does not enumerate a newly designed environment's attack surface. The OSI model is a conceptual framework for network communication layers; it can help organize controls, but it does not identify an environment's exposed assets. The Cyber Kill Chain describes phases of an adversary's intrusion and supports detection and hunting, not design-time attack-surface mapping. None of these three provides the data-flow and trust-boundary analysis associated with the SDLC.Community Comment Notes
The only substantive comment, from effa952, argues that the SDLC design phase uses threat modeling to map data flows, trust boundaries, and open ports, and that none of the other options really map out an attack surface. That reasoning aligns with the design-time attack-surface analysis the question is asking about. No vote distribution was provided, so the conclusion rests on the question wording and security lifecycle doctrine rather than popularity.Official Reference
Exam Strategy
When a question mentions a "new environment," look for a design, build, or lifecycle activity rather than a detection or response model. Tie attack-surface identification to threat modeling inside the SDLC, and eliminate options that describe incident handling or attacker phases.
Frequently Asked Questions
Why is the Cyber Kill Chain not the right answer for attack-surface identification?
The Cyber Kill Chain describes the stages of an intrusion after an adversary acts; it does not map the data flows, trust boundaries, or exposed services that define a new environment's attack surface.
Where in the SDLC is a new environment's attack surface usually identified?
During design, threat modeling maps data flows, trust boundaries, open ports, and exposed services so the attack surface can be reduced before deployment.