Tools / Microsoft Threat Modeling Tool (TMT) Interview questions
1. What is the Microsoft Threat Modeling Tool (TMT)?
The Microsoft Threat Modeling Tool (TMT) is a free desktop application that helps development and security teams find design-level security weaknesses before a single line of code is written. You build a data flow diagram (DFD) of your system using...
2. What is STRIDE?
STRIDE is the mnemonic TMT uses to classify every threat it generates, standing for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Category Violates Spoofing Authentication Tampering Integrity Repudiation Non-repudiation Information Disclo
3. What are the main elements used in a TMT data flow diagram?
A TMT diagram is built from four core element types plus one boundary marker. Element Represents External Entity A user or system outside your control (browser, third-party API) Process Code that receives, transforms, or produces data (a service, function, app)...
4. What is a trust boundary in TMT?
A trust boundary is a dashed line or box you draw on a diagram to mark the point where data moves between two zones with different levels of trust, for example between a public internet client and your internal network,...
5. What is a data flow in a threat model diagram?
A data flow is the arrow connecting two elements on a TMT diagram, representing data moving from one to the other, such as a browser sending a login request to a web server. Direction matters: a flow can be one-way...
6. What is a data store in TMT?
A data store represents any place where data is persisted rather than just passed through: a relational database, a file on disk, a message queue, or a cache. Because a data store doesn't actively execute logic the way a process...
7. What is an external entity in TMT?
An external entity is anything that interacts with your system but sits outside the boundary you control and are modeling - a human user, a partner API, or another team's service you don't own. Because you have no direct control...
8. What is a process element in TMT?
A process represents running code that receives input, does something with it, and typically produces output - a web application, a microservice, an API endpoint, or a background worker. Processes are the only element type subject to all six STRIDE...
9. Is the Microsoft Threat Modeling Tool free to use?
Yes. TMT is a free download from Microsoft with no license fee, and there's no restriction against using it on commercial products - it's distributed as part of Microsoft's broader push to make SDL practices accessible to any team, not...
10. What operating systems does TMT run on?
TMT is a Windows desktop application built on WPF (.NET), so it runs natively only on Windows. There's no official macOS or Linux build....
11. What file format does TMT use to save models?
TMT saves a model as a file with the .tm7 extension, which internally is a JSON document containing every diagram element, its properties, the trust boundaries, and the full list of generated threats along with their state, priority, and justification...
12. What is a threat modeling template in TMT?
A template is the reusable set of stencils, element properties, and threat-generation rules that TMT applies whenever you build a model. The default is Microsoft's general-purpose SDL template, which covers generic web and cloud architectures....
13. Define the "Not Started" threat state in TMT?
"Not Started" is the default state every threat is given the moment TMT's engine generates it - it simply means the threat has been identified but no one on the team has reviewed, triaged, or acted on it yet. It's...
14. List the threat states available for a generated threat in TMT?
By default, every generated threat moves through one of four states as your team reviews it: Not Started - identified, not yet reviewed. Needs Investigation - under review, more information required before a decision....
15. What is the purpose of the Threat Model Report in TMT?
The report is TMT's shareable, human-readable output: an HTML document listing every generated threat with its category, description, priority, current state, and any justification or mitigation notes the team recorded. It exists to turn the working model - which lives...
16. How do you create a new threat model in TMT?
The basic workflow is the same regardless of what you're modeling: Open TMT and choose File > New, selecting a template (default SDL template, or a custom one your org maintains). Drag External Entity, Process, and Data Store stencils onto...
17. What are the types of shapes you can add to a TMT diagram?
Beyond the four core DFD stencils - external entity, process, data store, data flow - templates can ship specialized stencils that visually represent something more specific, such as a named Azure service icon, while still inheriting the underlying base type's...
18. Describe the Analysis view in TMT?
The Analysis view is the tab you switch to after building a diagram - it's where the generated threat list actually lives, separate from the visual canvas. From here you can filter or sort threats by STRIDE category, priority, or...
19. How does TMT automatically generate threats from a diagram?
Each template bundles a set of rule definitions, and every rule pairs a trigger condition (an element type, plus properties like "crosses a trust boundary" or "is bidirectional") with a STRIDE category and a piece of templated description text. When...
20. Why does TMT generate more threats for data flows crossing trust boundaries?
Crossing a trust boundary means data is moving from one trust context into another where the receiving side has no inherent way to vouch for the sender's identity or the integrity of the environment it came from. Template rules specifically...
21. What is the difference between STRIDE and DREAD?
STRIDE DREAD Classifies what kind of threat something is Scores how severe an already-identified threat is Six fixed categories Five scored factors: Damage, Reproducibility, Exploitability, Affected users, Discoverability Used by TMT to generate the threat list itself Not used by...
22. How do you customize a TMT template to add a new threat type?
Open the template in TMT's template editor, and either extend an existing stencil's properties or define a new one if the concept doesn't map cleanly onto an existing element type. Then author a new threat-generation rule: specify the target element...
23. Why is a bidirectional data flow treated differently than unidirectional in TMT?
A bidirectional flow really represents two logical channels layered onto one arrow - a request going one way and a response coming back the other - and each direction can independently be tampered with, spoofed, or intercepted. Because of that,...
24. When should you use a custom template instead of the default SDL template?
Reach for a custom template when the default's generic web/cloud stencils don't represent your architecture's real risk profile - for example, an IoT product with firmware and radio interfaces, or a heavily serverless architecture built on managed queues and functions...
25. How does TMT map STRIDE categories to specific diagram elements?
The default SDL template follows Microsoft's published mapping, which assigns categories based on which security property each element type can realistically violate. Element Typical STRIDE categories External Entity Spoofing, Repudiation Process All six categories Data Store Tampering, Informati
26. What is the difference between a threat's Priority and its State in TMT?
Priority (typically High, Medium, or Low) reflects the estimated severity of the underlying issue if it were actually exploited - it's a judgment about risk, often defaulted by the template based on the rule that generated the threat and adjustable...
27. Why doesn't TMT integrate directly into CI/CD pipelines?
TMT is a Windows GUI desktop application built around manual diagramming, with no first-party command-line interface or REST API for a pipeline to call. The fact that .tm7 files are plain JSON means a script can still parse them -...
28. How do you troubleshoot missing threats after adding a new element in TMT?
A handful of causes account for most cases where a newly added element doesn't produce the threats you expected: The element was placed on the canvas but never actually connected via a data flow - unconnected shapes don't trigger flow-related...
29. What is the difference between TMT and OWASP Threat Dragon?
Microsoft TMT OWASP Threat Dragon Windows-only desktop app Cross-platform (web app or Electron desktop) .tm7 JSON format, Microsoft-authored templates Its own JSON schema, open-source community maintained Rich template-driven rule engine with pre-built SDL rules Simpler STRIDE prompts per element
30. When would you choose IriusRisk over TMT for an enterprise program?
IriusRisk makes more sense once a single desktop file per model stops scaling - specifically when you need centralized, web-based collaboration across many teams working on dozens or hundreds of models simultaneously. Its API-first architecture supports native integration into CI/CD...
31. How is a mitigation documented for a threat in TMT?
In the Analysis view, you open the specific threat entry and use its free-text Justification field to describe the compensating control or fix that addresses it, then update the State to Mitigated (or leave it at Needs Investigation while work...
32. Why should you re-run threat generation after editing an existing data flow?
TMT computes threats at the moment you click Generate, based on each element's state at that exact time - it doesn't retroactively recompute anything when you later change a flow's direction, its connected endpoints, or whether it now crosses a...
33. What happens when you delete an element that already has generated threats?
Its associated threats are removed too, in a cascading delete - along with any Justification notes and state history you had recorded against them. That's a meaningful loss if the element was removed for reasons unrelated to the risk itself...
34. How do you migrate an older.tms model into the current TMT template format?
Earlier tool generations saved models as .tms XML files bound to their own legacy template structure, which isn't directly compatible with the current .tm7 JSON-based template system. A migration utility reads the legacy XML, remaps its stencils and previously generated...
35. Explain the execution flow when TMT generates a threat report?
Report generation is a purely local, one-way pipeline - there's no server round trip involved. flowchart TD A[Diagram on canvas] --> B[Analysis view aggregates generated threats] B --> C[User filters/sorts and finalizes triage: state, priority, justification] C --> D[Create Report...
36. Explain the lifecycle of a threat model from creation to mitigation in TMT?
A threat model isn't a one-time deliverable - it's meant to track the system across its life, though TMT itself only actively participates in a few of these stages. flowchart LR A[Define scope, pick template] --> B[Build the DFD] B...
37. Explain the internal working of TMT's rule-based threat generation engine?
The template file stores a set of declarative rule definitions rather than the tool having threat logic hardcoded into its own compiled code. Each rule specifies three things: a target element type it applies to, a trigger predicate evaluated against...
38. How can you optimize threat modeling for a large microservices architecture using TMT?
TMT models one architecture per file and has no cross-model dashboard, so trying to draw every service and every call in one diagram quickly becomes unreadable and slow to regenerate. A more workable approach is modeling at bounded-context granularity: one...
39. Explain the internal working of trust boundary crossing detection in TMT?
A trust boundary is rendered on the canvas as a shape with real geometric bounds - a line segment or an enclosing box - just like any other diagram object has a position and size. flowchart LR subgraph Zone_A[Untrusted zone]...
40. Why is version-controlling.tm7 files important in a microservices environment?
Microservices architectures change frequently - new dependencies get added, data stores move, services split - and an un-versioned .tm7 file drifts out of sync with reality just as quickly, silently invalidating the threats it describes without any warning from the...
41. Explain the difference between TMT's DFD-based approach and attack-tree-based threat modeling?
DFD-based (TMT) Attack-tree-based Models the whole system's structure Starts from one attacker goal at the root Breadth-first: STRIDE checked against every element Depth-first: decomposes one goal into AND/OR sub-paths Optimized for broad coverage Optimized for reasoning deeply about a specific...
42. Why is STRIDE-per-element considered more systematic than ad hoc brainstorming?
A free-form brainstorming session depends heavily on which specific people happen to be in the room and which attacks happen to occur to them that day, so coverage varies session to session and is hard to compare across teams or...
43. How do you troubleshoot duplicate threats appearing across two overlapping diagrams?
This is a modeling-boundary problem rather than a bug in the engine - it happens when two separate .tm7 files both model the same shared component, such as a common authentication service, as a full internal process rather than one...
44. Explain the difference between TMT and PASTA methodology in interview terms?
TMT is a tool implementing one specific technique - STRIDE-per-element applied to a data flow diagram. PASTA (Process for Attack Simulation and Threat Analysis) is a much broader, seven-stage risk-centric methodology that starts from business objectives, moves through technical scope,...
45. How can you integrate a TMT.tm7 file into an automated security pipeline?
Since .tm7 is plain JSON, a script can load it directly and inspect the threat list without needing TMT installed on the build agent at all - enough to build lightweight gating logic even though there's no official API. import...
46. Why does removing a trust boundary line change threat count without deleting elements?
Boundary-crossing threat count depends on the crossing flag computed from the geometric relationship between data flows and trust boundaries at generation time - it isn't a property stored permanently on the elements or flows themselves. Delete the boundary line, and...
47. Explain how custom threat properties extend the default TMT threat template schema?
Out of the box, each generated threat carries a fixed set of fields: Title, Category (its STRIDE classification), Description, Justification, Priority, and State. A custom template can define additional properties on top of that default schema - for example a...
48. How do you handle threats marked "Not Applicable" during an audit?
An auditor should expect to find a specific, substantive justification attached to every Not Applicable threat, not just the bare state label sitting there on its own. The discipline is to always fill in the Justification field with the concrete...
49. Explain the security implications of not updating a threat model after an architecture change?
A threat model encodes a set of assumptions about trust boundaries, data flows, and component responsibilities as they existed at a specific point in time. When the real architecture changes - a new external integration is added, a data store...
50. Which is better for a fast-moving cloud-native team: TMT or a lightweight open-source alternative, and why?
Neither is universally better - the right choice depends on which constraints actually bind for a given team. TMT's strength is a mature, Microsoft-maintained rule engine with deep, pre-built SDL and Azure-oriented templates, which is valuable when an org already...
