In threat modeling, which activity is identified as part of the process?

• A. Vulnerability testing
• B. Payroll processing
• C. Brand management
• D. Customer support ticketing

Answer: (A)

Threat modeling focuses on identifying assets, potential attackers, attack surfaces, and weaknesses so you can understand likely attack paths and design effective mitigations. An essential activity in this process is vulnerability testing, where you probe the system to discover exploitable flaws and validate whether the identified threat scenarios can actually be triggered. This moves you from theoretical risks to concrete weaknesses that need controls. The other options—payroll processing, brand management, and customer support ticketing—are business or operational activities and do not involve analyzing security threats or weaknesses in a system.