A company is designing a new service. Which threat-modeling question most directly identifies a possible attack point?

### Why this is right Threat modeling asks where an attacker could interact with a system. Those interaction points help analysts reason about attack paths, potential harm, and appropriate controls. ### The concept An interaction point is a place where input, access, or communication reaches a system. Mapping such points alongside data movement helps reveal how a system might be attacked. The goal is to connect possible attacks to consequences and safeguards. ### The other options - **B. Which employees have the longest tenure?**: tenure alone does not identify an attack point. - **C. Which security tool has the most features?**: tools should be selected according to risks, not feature count. - **D. How many documents were printed last month?**: this does not directly reveal how an attacker could interact with the service. ### Remember Threat modeling follows paths into and through a system.