Before a SaaS company builds a new billing feature, the team lists ways an attacker could tamper with the payment call. Which term names that design-time work?
Select an answer to reveal the explanation.
Short Explanation
You’re doing threat modeling when you list how an attacker could tamper with a payment call before the billing feature is built. Threat hunting searches production logs for ongoing abuse, malware analysis examines a collected sample, and incident containment isolates a host after a confirmed intrusion.
Full Explanation
Threat modeling is the design-time work of listing plausible ways an attacker could tamper with the payment call before the billing feature is built. The team can use that list to choose controls before the call exists in production. Threat hunting in production logs searches for payment abuse already affecting live customers; it does not fit a design question about a feature that has not been built. Malware analysis examines a sample collected from a customer workstation, but the team has no sample to dissect and is instead considering how the payment call could be abused. Incident containment isolates a host after a confirmed intrusion into the billing path; here, no intrusion has been confirmed, and the team is planning rather than responding to an incident. Exam caveat: a threat model identifies plausible tampering; it does not prove an attack has occurred or replace monitoring after the feature ships. Practical check: keep each listed tamper case alongside the payment-call design and verify that a control addresses it before the feature is built.