Tools / Microsoft Threat Modeling Tool (TMT) Interview questions
1. What is the Microsoft Threat Modeling Tool (TMT)?
The Microsoft Threat Modeling Tool (TMT) is a free desktop application that helps development and security teams find design-level security weaknesses before a single line of code is written. You build a data flow diagram (DFD) of your system using stencils for external entities, processes, data ...
2. What is STRIDE?
STRIDE is the mnemonic TMT uses to classify every threat it generates, standing for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Category Violates Spoofing Authentication Tampering Integrity Repudiation Non-repudiation Information Disclo...
3. What are the main elements used in a TMT data flow diagram?
A TMT diagram is built from four core element types plus one boundary marker. Element Represents External Entity A user or system outside your control (browser, third-party API) Process Code that receives, transforms, or produces data (a service, function, app) Data Store Persistent storage such ...
4. What is a trust boundary in TMT?
A trust boundary is a dashed line or box you draw on a diagram to mark the point where data moves between two zones with different levels of trust, for example between a public internet client and your internal network, or between two teams' services. It doesn't represent a physical component the...
5. What is a data flow in a threat model diagram?
A data flow is the arrow connecting two elements on a TMT diagram, representing data moving from one to the other, such as a browser sending a login request to a web server. Direction matters: a flow can be one-way or marked bidirectional, and TMT treats the two differently at generation time. A ...
6. What is a data store in TMT?
A data store represents any place where data is persisted rather than just passed through: a relational database, a file on disk, a message queue, or a cache. Because a data store doesn't actively execute logic the way a process does, TMT's default rules generally don't apply Spoofing or Elevatio...
7. What is an external entity in TMT?
An external entity is anything that interacts with your system but sits outside the boundary you control and are modeling - a human user, a partner API, or another team's service you don't own. Because you have no direct control over an external entity's internal behavior, TMT's rules focus its g...
8. What is a process element in TMT?
A process represents running code that receives input, does something with it, and typically produces output - a web application, a microservice, an API endpoint, or a background worker. Processes are the only element type subject to all six STRIDE categories by default: a process can be imperson...
9. Is the Microsoft Threat Modeling Tool free to use?
Yes. TMT is a free download from Microsoft with no license fee, and there's no restriction against using it on commercial products - it's distributed as part of Microsoft's broader push to make SDL practices accessible to any team, not just internal Microsoft product groups. There's no paid tier,...
10. What operating systems does TMT run on?
TMT is a Windows desktop application built on WPF (.NET), so it runs natively only on Windows. There's no official macOS or Linux build. Teams on those platforms typically run it in a Windows virtual machine, or choose a cross-platform alternative such as OWASP Threat Dragon when a native, non-Wi...
11. What file format does TMT use to save models?
TMT saves a model as a file with the .tm7 extension, which internally is a JSON document containing every diagram element, its properties, the trust boundaries, and the full list of generated threats along with their state, priority, and justification text. Because it's plain JSON rather than a p...
12. What is a threat modeling template in TMT?
A template is the reusable set of stencils, element properties, and threat-generation rules that TMT applies whenever you build a model. The default is Microsoft's general-purpose SDL template, which covers generic web and cloud architectures. Organizations can author custom templates that add sp...
13. Define the "Not Started" threat state in TMT?
"Not Started" is the default state every threat is given the moment TMT's engine generates it - it simply means the threat has been identified but no one on the team has reviewed, triaged, or acted on it yet. It's a starting point, not a judgment about severity; a Not Started threat could turn ou...
14. List the threat states available for a generated threat in TMT?
By default, every generated threat moves through one of four states as your team reviews it: Not Started - identified, not yet reviewed. Needs Investigation - under review, more information required before a decision. Mitigated - a control has been implemented and documented. Not Applicable - rev...
15. What is the purpose of the Threat Model Report in TMT?
The report is TMT's shareable, human-readable output: an HTML document listing every generated threat with its category, description, priority, current state, and any justification or mitigation notes the team recorded. It exists to turn the working model - which lives inside a desktop tool most ...
16. How do you create a new threat model in TMT?
The basic workflow is the same regardless of what you're modeling: Open TMT and choose File > New, selecting a template (default SDL template, or a custom one your org maintains). Drag External Entity, Process, and Data Store stencils onto the canvas for each real component. Connect them with Dat...
17. What are the types of shapes you can add to a TMT diagram?
Beyond the four core DFD stencils - external entity, process, data store, data flow - templates can ship specialized stencils that visually represent something more specific, such as a named Azure service icon, while still inheriting the underlying base type's threat-generation behavior. So a ste...
18. Describe the Analysis view in TMT?
The Analysis view is the tab you switch to after building a diagram - it's where the generated threat list actually lives, separate from the visual canvas. From here you can filter or sort threats by STRIDE category, priority, or state, click into an individual threat to read its auto-generated d...
19. How does TMT automatically generate threats from a diagram?
Each template bundles a set of rule definitions, and every rule pairs a trigger condition (an element type, plus properties like "crosses a trust boundary" or "is bidirectional") with a STRIDE category and a piece of templated description text. When you click Generate All Threats, the engine walk...
20. Why does TMT generate more threats for data flows crossing trust boundaries?
Crossing a trust boundary means data is moving from one trust context into another where the receiving side has no inherent way to vouch for the sender's identity or the integrity of the environment it came from. Template rules specifically check the "crosses trust boundary" flag on a data flow, ...
21. What is the difference between STRIDE and DREAD?
STRIDE DREAD Classifies what kind of threat something is Scores how severe an already-identified threat is Six fixed categories Five scored factors: Damage, Reproducibility, Exploitability, Affected users, Discoverability Used by TMT to generate the threat list itself Not used by TMT's default en...
22. How do you customize a TMT template to add a new threat type?
Open the template in TMT's template editor, and either extend an existing stencil's properties or define a new one if the concept doesn't map cleanly onto an existing element type. Then author a new threat-generation rule: specify the target element type it should apply to, the trigger condition ...
23. Why is a bidirectional data flow treated differently than unidirectional in TMT?
A bidirectional flow really represents two logical channels layered onto one arrow - a request going one way and a response coming back the other - and each direction can independently be tampered with, spoofed, or intercepted. Because of that, the rule engine evaluates threat conditions for both...
24. When should you use a custom template instead of the default SDL template?
Reach for a custom template when the default's generic web/cloud stencils don't represent your architecture's real risk profile - for example, an IoT product with firmware and radio interfaces, or a heavily serverless architecture built on managed queues and functions where the generic "process" ...
25. How does TMT map STRIDE categories to specific diagram elements?
The default SDL template follows Microsoft's published mapping, which assigns categories based on which security property each element type can realistically violate. Element Typical STRIDE categories External Entity Spoofing, Repudiation Process All six categories Data Store Tampering, Informati...
26. What is the difference between a threat's Priority and its State in TMT?
Priority (typically High, Medium, or Low) reflects the estimated severity of the underlying issue if it were actually exploited - it's a judgment about risk, often defaulted by the template based on the rule that generated the threat and adjustable by the reviewer. State (Not Started, Needs Inves...
27. Why doesn't TMT integrate directly into CI/CD pipelines?
TMT is a Windows GUI desktop application built around manual diagramming, with no first-party command-line interface or REST API for a pipeline to call. The fact that .tm7 files are plain JSON means a script can still parse them - counting threat states, diffing two revisions - which is how teams...
28. How do you troubleshoot missing threats after adding a new element in TMT?
A handful of causes account for most cases where a newly added element doesn't produce the threats you expected: The element was placed on the canvas but never actually connected via a data flow - unconnected shapes don't trigger flow-related rules at all. A generic stencil was used instead of th...
29. What is the difference between TMT and OWASP Threat Dragon?
Microsoft TMT OWASP Threat Dragon Windows-only desktop app Cross-platform (web app or Electron desktop) .tm7 JSON format, Microsoft-authored templates Its own JSON schema, open-source community maintained Rich template-driven rule engine with pre-built SDL rules Simpler STRIDE prompts per element...
30. When would you choose IriusRisk over TMT for an enterprise program?
IriusRisk makes more sense once a single desktop file per model stops scaling - specifically when you need centralized, web-based collaboration across many teams working on dozens or hundreds of models simultaneously. Its API-first architecture supports native integration into CI/CD pipelines and...
31. How is a mitigation documented for a threat in TMT?
In the Analysis view, you open the specific threat entry and use its free-text Justification field to describe the compensating control or fix that addresses it, then update the State to Mitigated (or leave it at Needs Investigation while work is pending). That text is carried verbatim into the g...
32. Why should you re-run threat generation after editing an existing data flow?
TMT computes threats at the moment you click Generate, based on each element's state at that exact time - it doesn't retroactively recompute anything when you later change a flow's direction, its connected endpoints, or whether it now crosses a trust boundary. Skip the re-generation and you end u...
33. What happens when you delete an element that already has generated threats?
Its associated threats are removed too, in a cascading delete - along with any Justification notes and state history you had recorded against them. That's a meaningful loss if the element was removed for reasons unrelated to the risk itself (say, a component was renamed and re-drawn rather than t...
34. How do you migrate an older.tms model into the current TMT template format?
Earlier tool generations saved models as .tms XML files bound to their own legacy template structure, which isn't directly compatible with the current .tm7 JSON-based template system. A migration utility reads the legacy XML, remaps its stencils and previously generated threats to the closest equ...
35. Explain the execution flow when TMT generates a threat report?
Report generation is a purely local, one-way pipeline - there's no server round trip involved. flowchart TD A[Diagram on canvas] --> B[Analysis view aggregates generated threats] B --> C[User filters/sorts and finalizes triage: state, priority, justification] C --> D[Create Report action] D --> E...
36. Explain the lifecycle of a threat model from creation to mitigation in TMT?
A threat model isn't a one-time deliverable - it's meant to track the system across its life, though TMT itself only actively participates in a few of these stages. flowchart LR A[Define scope, pick template] --> B[Build the DFD] B --> C[Generate All Threats] C --> D[Triage: set state per threat]...
37. Explain the internal working of TMT's rule-based threat generation engine?
The template file stores a set of declarative rule definitions rather than the tool having threat logic hardcoded into its own compiled code. Each rule specifies three things: a target element type it applies to, a trigger predicate evaluated against that element's or connector's actual propertie...
38. How can you optimize threat modeling for a large microservices architecture using TMT?
TMT models one architecture per file and has no cross-model dashboard, so trying to draw every service and every call in one diagram quickly becomes unreadable and slow to regenerate. A more workable approach is modeling at bounded-context granularity: one diagram per service, or per a small clus...
39. Explain the internal working of trust boundary crossing detection in TMT?
A trust boundary is rendered on the canvas as a shape with real geometric bounds - a line segment or an enclosing box - just like any other diagram object has a position and size. flowchart LR subgraph Zone_A[Untrusted zone] E[External Entity] end subgraph Zone_B[Trusted zone] P[Process] end E --...
40. Why is version-controlling.tm7 files important in a microservices environment?
Microservices architectures change frequently - new dependencies get added, data stores move, services split - and an un-versioned .tm7 file drifts out of sync with reality just as quickly, silently invalidating the threats it describes without any warning from the tool itself. Storing the model ...
41. Explain the difference between TMT's DFD-based approach and attack-tree-based threat modeling?
DFD-based (TMT) Attack-tree-based Models the whole system's structure Starts from one attacker goal at the root Breadth-first: STRIDE checked against every element Depth-first: decomposes one goal into AND/OR sub-paths Optimized for broad coverage Optimized for reasoning deeply about a specific s...
42. Why is STRIDE-per-element considered more systematic than ad hoc brainstorming?
A free-form brainstorming session depends heavily on which specific people happen to be in the room and which attacks happen to occur to them that day, so coverage varies session to session and is hard to compare across teams or across time. Walking every element against a fixed six-category chec...
43. How do you troubleshoot duplicate threats appearing across two overlapping diagrams?
This is a modeling-boundary problem rather than a bug in the engine - it happens when two separate .tm7 files both model the same shared component, such as a common authentication service, as a full internal process rather than one of them treating it as an external dependency. The fix is to assi...
44. Explain the difference between TMT and PASTA methodology in interview terms?
TMT is a tool implementing one specific technique - STRIDE-per-element applied to a data flow diagram. PASTA (Process for Attack Simulation and Threat Analysis) is a much broader, seven-stage risk-centric methodology that starts from business objectives, moves through technical scope, threat and ...
45. How can you integrate a TMT.tm7 file into an automated security pipeline?
Since .tm7 is plain JSON, a script can load it directly and inspect the threat list without needing TMT installed on the build agent at all - enough to build lightweight gating logic even though there's no official API. import json with open( "service-a.tm7" ) as f: model = json . load(f) threats...
46. Why does removing a trust boundary line change threat count without deleting elements?
Boundary-crossing threat count depends on the crossing flag computed from the geometric relationship between data flows and trust boundaries at generation time - it isn't a property stored permanently on the elements or flows themselves. Delete the boundary line, and on the next Generate run ever...
47. Explain how custom threat properties extend the default TMT threat template schema?
Out of the box, each generated threat carries a fixed set of fields: Title, Category (its STRIDE classification), Description, Justification, Priority, and State. A custom template can define additional properties on top of that default schema - for example a dropdown mapping a threat to a specif...
48. How do you handle threats marked "Not Applicable" during an audit?
An auditor should expect to find a specific, substantive justification attached to every Not Applicable threat, not just the bare state label sitting there on its own. The discipline is to always fill in the Justification field with the concrete reason that STRIDE category doesn't apply to that p...
49. Explain the security implications of not updating a threat model after an architecture change?
A threat model encodes a set of assumptions about trust boundaries, data flows, and component responsibilities as they existed at a specific point in time. When the real architecture changes - a new external integration is added, a data store moves outside a previously trusted boundary, a monolit...
50. Which is better for a fast-moving cloud-native team: TMT or a lightweight open-source alternative, and why?
Neither is universally better - the right choice depends on which constraints actually bind for a given team. TMT's strength is a mature, Microsoft-maintained rule engine with deep, pre-built SDL and Azure-oriented templates, which is valuable when an org already has Windows tooling standardizati...
