Correct Answer: C. Decomposing the application. Threat modeling procedures commonly include decomposing the application to understand its components, data flows, trust boundaries, and attack surfaces. The OWASP Web Security Testing Guide incorporates structured analysis of application architecture as part of identifying and evaluating potential threats. Why The Other Options Are Incorrect A. Review of security requirements Reviewing security requirements is part of secure development lifecycle a

B. Establish a plan of action. The standard troubleshooting methodology follows this order: identify the problem, establish a theory of probable cause, test the theory, establish a plan of action to resolve the problem and identify potential effects, implement the solution, verify full system functionality and implement preventive measures, then document findings. Since the theory has already been tested, the next step is to plan the fix. Why The Other Options Are Incorrect A. Develop a theory.

Correct Answer: D. Physical. The scenario describes an attempt to gain unauthorized entry into a restricted area using an access badge. This tests physical security controls such as badges, locks, guards, and access control systems, not network or logical defenses. Why The Other Options Are Incorrect: A. Defensive Defensive refers to protective controls and monitoring measures. The scenario involves active testing of controls, not defensive implementation. B. Passive Passive testing involves obs