Question
Which of the following explains the reason a tester would opt to use DREAD over PTES during the planning phase of a penetration test?
- A. The tester is conducting a web application test.
- B. The tester is assessing a mobile application.
- C. The tester is evaluating a thick client application.
- D. The tester is creating a threat model. Correct
Explanation
DREAD (Damage, Reproducibility, Exploitability, Affected users, Discoverability) is a threat-modeling framework used to rate and prioritize threats, while PTES is a methodology describing the phases of a whole penetration test. Choosing DREAD therefore makes sense when the goal is to build a threat model. The type of application being tested (web, mobile or thick client) does not by itself call for DREAD instead of PTES.
