After identifying the threats to a cloud API, a team needs to prioritize them by scoring each one on how much harm it could cause, how easily it can be reproduced and exploited, how many users it would affect, and how easily it could be found. Which model is designed for this rating step?

DREAD is a risk-rating model used after threats have been identified. Each threat is scored on five factors: damage potential, reproducibility, exploitability, affected users and discoverability, and the scores are combined to rank threats so that mitigation effort goes to the most serious ones first. It is often paired with a threat identification method rather than used on its own, and its scores are subjective, so teams calibrate them with shared definitions. STRIDE is a classification scheme for identifying threats by the security property they violate, such as spoofing or tampering; it helps a team find threats per element of a data flow diagram but does not score or rank them. PASTA, the Process for Attack Simulation and Threat Analysis, is a seven-stage, risk-centric methodology that starts from business objectives and ends with risk analysis and countermeasures; it is a full process rather than a scoring formula for an existing threat list. ATASM, standing for architecture, threats, attack surfaces and mitigations, is an approach for working through a system's structure to identify threats and choose defenses, again not a rating scheme. Exam caveat: the 2026 outline lists DREAD among the threat models in objective 4.3; its first factor is damage, whatever a misprint may suggest. Operational check: confirm the threat register records a rating for each threat and that remediation priority follows those ratings.