A team is modeling a database system and considers a possible structured query language injection attack. What is the main purpose of this activity?

### Why this is right Considering an injection attack is an example of identifying a possible threat to a system and evaluating what controls could prevent or reduce harm. Modeling a threat does not prove that an incident has occurred. ### The concept Threat modeling is prospective: it examines what could happen and where a system may be exposed. A database may be an important asset, and an attack could threaten the information it stores. The organization uses the analysis to prioritize threats and evaluate safeguards. No model can guarantee that every attack will be prevented. ### The other options - **To prove that the database has already been breached**: a possible attack scenario is not evidence of a completed incident. - **To replace the organization’s asset inventory**: modeling uses knowledge of assets; it does not remove the need to identify them. - **To guarantee that no attack can occur**: controls can reduce risk, but the lesson does not claim they eliminate every possible attack. ### Terms - **Structured query language injection**: an attack that attempts to make an application send unintended database commands. ### Remember Threat modeling asks what could happen, not only what has happened.