The Life Starter
Sign up
Grade 9 · lesson 1 of 4

Separate Assets, Threats and Vulnerabilities

Classify the statement’s role in the threat model before selecting a control.

About 22 minutes, plus any extended practice

Download the grade pack

Supplied materials

  • Paper and pencil; answers may also be spoken or typed.
  • All cases, labels, numbers and rules are supplied on this page. No real account, private information or purchase is needed.

Learn the idea

A threat model begins with what needs protection and how it might be harmed. An asset is something valuable; a threat is a possible harmful event or actor; a vulnerability is a weakness that can enable harm. A control addresses a risk. These roles should not be mixed together.

Classify the stated role before selecting a control. Valuable document contents are assets even inside a backup; creating and maintaining that backup is a control. A control name alone does not prove that a threat or weakness has been addressed.

Use this supplied case: Saved private project contents. Which threat-model role is described? The task is to connect the given information to the computing idea. Write a short evidence trail so another learner can reproduce your choice. The simplified case describes the stated model, not every real system.

  1. Represent the supplied worked case with a labeled drawing, table or short trace.
  2. Classify the statement’s role in the threat model before selecting a control.
  3. Explain why the worked answer fits and why one alternative does not.
  4. Try the new check and practice cases; revisit the stated rule if your evidence does not match.
Worked example

See the method in action

Saved private project contents. Which threat-model role is described? The supported answer is Asset. Classify the statement’s role in the threat model before selecting a control. A control name does not prove that a threat or weakness has been addressed. A threat model begins with what needs protection and how it might be harmed.

Your turn

Check your reasoning

Your answer is temporary and is not saved to an account. Download your current answer before leaving or reloading. Written work on paper or in another app stays in your own file.

Helpful tips
  • Classify the statement’s role in the threat model before selecting a control.
  • A control name does not prove that a threat or weakness has been addressed.
Unauthorized person tries to read private work. Which threat-model role is described?

Feedback appears here after you check. This is practice, not a graded school assessment.

See the answer and explanation

Threat

The supplied case states: Unauthorized person tries to read private work. Which threat-model role is described? Under the stated distinction, this identifies Threat. A threat model begins with what needs protection and how it might be harmed. An asset is something valuable; a threat is a possible harmful event or actor; a vulnerability is a weakness that can enable harm. A control addresses a risk. These roles should not be mixed together. Classify the statement’s role in the threat model before selecting a control.

Take it further

A protected draft is the asset, an unauthorized read is the threat, an omitted permission check the vulnerability, and a server check a control. Keep all four roles distinct.

Nothing here is saved to an account or sent to a teacher. The answer download includes your current choice and any checked feedback. It does not include choices from the separate More practice section. Download that section separately.

More practice: try new cases

Choose an answer for each problem. Explain your method on paper, then use the feedback to decide what to revisit.

More practice: try new cases
1. Server omits its permission check. Which threat-model role is described?
Need a hint?
  • Classify the statement’s role in the threat model before selecting a control.
  • A control name does not prove that a threat or weakness has been addressed.
2. Server verifies access before returning records. Which threat-model role is described?
Need a hint?
  • Classify the statement’s role in the threat model before selecting a control.
  • A control name does not prove that a threat or weakness has been addressed.
3. A threat model identifies the valuable private document contents inside recovery copies as what must be protected. Which role describes those contents, rather than the backup-making process?
Need a hint?
  • Classify the statement’s role in the threat model before selecting a control.
  • A control name does not prove that a threat or weakness has been addressed.

Your choices are temporary. Feedback appears after you check all the answers.

Nothing here is saved to an account or sent to a teacher. Keep your own notes or download them before leaving. The score describes these questions; it does not certify subject mastery.

Check the subject sources

These LifeStarter passages, scenarios and exercises are authored for this Academy with AI assistance and review. External resources keep their publishers’ terms. A grade label suggests a starting level; it does not establish alignment with your school’s complete requirements.