{
  "module": "S07 — Threat Modeling Harnesses",
  "course": "2A — Building AI Harnesses for Cybersecurity",
  "version": "1.0.0",
  "duration_minutes": 35,
  "total_questions": 15,
  "bloom_distribution": {
    "target": "20% recall / 40% application / 40% analysis-design",
    "actual": { "recall": 3, "application": 6, "analysis": 6 }
  },
  "passing_score_percent": 70,
  "questions": [
    { "id": "Q01", "bloom": "recall", "type": "multiple_choice", "prompt": "What does STRIDE stand for?", "options": ["Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege", "Spoofing, Testing, Routing, Identity, Data, Encryption", "Spoofing, Tampering, Repudiation, Integrity, DoS, Elevation", "Scanning, Tampering, Recon, Injection, DoS, Escalation"], "answer_index": 0, "rationale": "STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Each maps to specific DFD element types, giving a systematic method." },
    { "id": "Q02", "bloom": "recall", "type": "multiple_choice", "prompt": "Which architecture inputs are treated as authoritative (source of truth)?", "options": ["draw.io diagrams and Mermaid", "Terraform/CloudFormation and OpenAPI specs — machine-verifiable declarations of what is deployed", "Email descriptions from the architect", "Whiteboard photos"], "answer_index": 1, "rationale": "IaC (Terraform/CloudFormation) and OpenAPI are machine-verifiable declarations of what is actually deployed. draw.io drifts — it is documentation, supplementary only." },
    { "id": "Q03", "bloom": "recall", "type": "multiple_choice", "prompt": "What are the four mitigation status values?", "options": ["New, Working, Done, Deleted", "Open, In progress, Mitigated, Accepted risk", "Low, Medium, High, Critical", "Draft, Review, Approved, Closed"], "answer_index": 1, "rationale": "Open (identified, not implemented), In progress (PR open), Mitigated (deployed, verified), Accepted risk (business decision, documented with approver + expiry)." },
    { "id": "Q04", "bloom": "application", "type": "multiple_choice", "prompt": "An aws_s3_bucket resource is parsed from Terraform. What DFD element type is it?", "options": ["External actor", "Process", "Data store", "Data flow"], "answer_index": 2, "rationale": "Resources map to element types by nature: aws_s3_bucket → data store, aws_lambda_function → process, aws_api_gateway_rest_api → service with external entry points." },
    { "id": "Q05", "bloom": "application", "type": "multiple_choice", "prompt": "A flow goes from a public-facing API gateway to an internal Lambda. The flow's source is in the internet boundary; its target is in the VPC boundary. What is true?", "options": ["The flow does not cross a boundary", "The flow crosses_boundary=true and is a highest-priority STRIDE analysis target", "The flow is irrelevant to threat modeling", "The flow should be removed from the DFD"], "answer_index": 1, "rationale": "The flow crosses a trust boundary (internet→VPC). Boundary-crossing flows are where the dangerous threats live — highest-priority analysis targets for the STRIDE engine." },
    { "id": "Q06", "bloom": "application", "type": "multiple_choice", "prompt": "The LLM generates 'An attacker might spoof authentication' for every service. What went wrong?", "options": ["The model is broken", "The threat generation prompt lacks GROUNDING — element technologies + flows + data. Without grounding, output is generic and useless", "STRIDE does not apply", "The DFD is too large"], "answer_index": 1, "rationale": "Grounding is the load-bearing instruction. Without specific technologies and flows, the model produces generic threats applicable to any service. With grounding, it produces specific, actionable, CVSS-scored threats." },
    { "id": "Q07", "bloom": "application", "type": "multiple_choice", "prompt": "A Terraform change removes an aws_lambda_function. What happens to the threats previously generated against it?", "options": ["They remain open forever", "They are automatically retired — traceability (element_id) ties threats to elements; removed elements retire their threats", "They are reassigned to a random element", "They must be manually deleted"], "answer_index": 1, "rationale": "Traceability is not decorative. Every threat carries element_id. When the model diffs versions and sees the element removed, its threats are automatically retired — keeping the model maintainable." },
    { "id": "Q08", "bloom": "application", "type": "multiple_choice", "prompt": "A threat is generated: 'stolen Cognito credentials bypass API Gateway controls.' The mitigation should map to which three layers?", "options": ["A slogan, a poster, a training video", "OWASP ASVS control, CWE remediation, cloud provider best practice — with a concrete implementation", "Only a CVSS score", "Only a Jira ticket number"], "answer_index": 1, "rationale": "Mitigations map to OWASP ASVS (e.g. V2.1.7 MFA), CWE remediation (e.g. CWE-308), and cloud best practice (e.g. AWS IAM condition keys). The mapping produces a concrete implementation, not a platitude." },
    { "id": "Q09", "bloom": "application", "type": "multiple_choice", "prompt": "Threats are generated and stored in a dedicated security tool. Engineers never open it. What is the fix?", "options": ["Force engineers to use the security tool", "Auto-create issues in the engineering tracker (GitHub/Linear/Jira) with full traceability back to the threat model", "Email the threat list weekly", "Print the threats and post them"], "answer_index": 1, "rationale": "Threats must live where engineers work. Auto-create issues with attack narrative, CVSS, mitigation, references, and traceability. Bidirectional status sync. Zero manual transcription." },
    { "id": "Q10", "bloom": "analysis", "type": "multiple_choice", "prompt": "Why does the STRIDE engine NOT analyze data stores for spoofing?", "options": ["Data stores cannot be attacked", "Spoofing means impersonating an identity; you don't impersonate a database. STRIDE is scoped per element type to prevent irrelevant threats", "Spoofing is not a real threat", "The model cannot generate spoofing threats"], "answer_index": 1, "rationale": "STRIDE applicability is scoped: external actors get spoofing + repudiation; processes get all six; data stores get tampering/repudiation/info-disclosure/DoS. Scoping prevents irrelevant threats and keeps the list credible." },
    { "id": "Q11", "bloom": "analysis", "type": "multiple_choice", "prompt": "Why does the harness treat IaC as authoritative and draw.io as supplementary?", "options": ["draw.io files are too large to parse", "IaC is a machine-verifiable declaration of what is actually deployed; draw.io is documentation that drifts the moment a change is merged", "draw.io does not contain components", "IaC is easier to read"], "answer_index": 1, "rationale": "IaC declares what is deployed and can be verified against the cloud. draw.io is human-maintained documentation that drifts. IaC + OpenAPI are authoritative; diagrams add context but cannot be source of truth." },
    { "id": "Q12", "bloom": "analysis", "type": "multiple_choice", "prompt": "When diffing two threat model versions, which delta is highest priority?", "options": ["A renamed variable", "A new flow crossing a trust boundary (e.g. new public-to-internal path) — where new exposures live", "A comment change in Terraform", "A reformatted diagram"], "answer_index": 1, "rationale": "New boundary-crossing flows are the highest-priority delta — they are an adversary's new path from low-trust to high-trust. Changed trust boundaries (resource moved private→public) are also high priority." },
    { "id": "Q13", "bloom": "analysis", "type": "multiple_choice", "prompt": "Why does continuous threat modeling require diffing, not full re-runs?", "options": ["Full re-runs are illegal", "Full re-runs on a large model are expensive and noisy; diffing means cost scales with the change, not architecture size. Only new/changed elements get analyzed", "Diffing is more accurate", "The DFD cannot be fully analyzed twice"], "answer_index": 1, "rationale": "Re-running STRIDE on the entire model on every change is prohibitive. Diffing versions and analyzing only the delta keeps cost bounded — continuous threat modeling becomes tractable." },
    { "id": "Q14", "bloom": "analysis", "type": "multiple_choice", "prompt": "Compare 'Use strong authentication' to a mapped mitigation. Why is the latter actionable?", "options": ["It is shorter", "It maps to OWASP ASVS V2.1.7, CWE-308, and AWS IAM condition keys requiring MFA for sts:AssumeRole — a concrete IaC change an engineer can implement in a PR", "It has more words", "It includes a logo"], "answer_index": 1, "rationale": "The mapped mitigation connects authoritative references (OWASP, CWE, cloud best practice) to a concrete implementation (Lambda policy + condition key). An engineer can implement it — it is not a platitude." },
    { "id": "Q15", "bloom": "analysis", "type": "multiple_choice", "prompt": "Why is the DFD the canonical intermediate representation rather than analyzing raw Terraform directly?", "options": ["Terraform is too hard to read", "It decouples ingestion from analysis: every downstream stage (STRIDE, mitigation, versioning) operates on the DFD. A new input source only needs a parser that emits DFD elements + flows", "The DFD is faster to compute", "Terraform cannot be parsed"], "answer_index": 1, "rationale": "The DFD abstracts over input sources. Adding a new source (CDK, SAM) only requires a new parser emitting DFD elements/flows — the analysis engine is unchanged. This decoupling is what makes the harness extensible." }
  ]
}