A fintech company is migrating payment APIs to AWS across three accounts and must show regulators a formal risk assessment with prioritized mitigations before launch. Threats include spoofed partner callbacks and tampered queue messages. Which risk assessment approach best identifies and mitigates these architecture-level threats?
Select an answer to reveal the explanation.
Short Explanation
Scans find known bugs, but design flaws need a different lens. Your threat model traces attacker paths through data flows so you can bake in the right defenses early.
Full Explanation
Threat modeling decomposes the payment architecture into data flows, trust boundaries, and actors, then systematically applies categories such as spoofing and tampering to identify abuse cases that code scans miss, with risk scoring driving mitigations like mutual TLS for callbacks and message signing for queues. Vulnerability scanning fails by concept because it finds known host and package weaknesses rather than reasoning about architecture-level spoofing and message integrity across accounts. CloudTrail plus GuardDuty fails by concept because detective controls provide post-deployment monitoring, not a pre-launch design risk assessment with prioritized mitigations. Penetration testing fails by concept because it validates exploitable issues late in the cycle and samples implementation flaws rather than comprehensively assessing design threats. Exam caveat: SAP-C03 expects threat modeling early in design, with controls traced to risks. Practical check: document a data-flow diagram, threat table, and mitigation owner for each high risk.