← ACARA Digital Technologies Years 9–10

Attack trees

A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives; AND branches are steps that are all needed.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 53

Understanding Attack trees in ACARA Digital Technologies Years 9–10

What it does: AND branches list steps that are all needed. If the attacker misses one step, the goal above is not reached. An attack tree starts with the goal at the top. The branches below show the different ways to reach it. OR branches are alternatives. The attacker only needs to succeed with one of them. With AND, all steps are needed. Removing one breaks the whole path.

Common mistakes: Guessing the password and phishing are two alternative ways to reach the goal, so each is an OR branch. AND would wrongly mean the attacker must do both. It should be ' OR: Phish the login details'. The top of an attack tree is the attacker's goal, not a defender's aim. Stopping theft is a defence. The root should be 'GOAL: Steal a student account'.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Attack trees to a class →

This module's key terms are also in a printable crossword (Modules 782–809) and word search (Modules 743–809).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Where does the attacker's goal go in an attack tree?

At the top of the tree (the root)At the bottom of the tree

Matches

Goal: Get into the school network AND: Guess a password AND: Steal a staff laptop

↓

Guessing a password and stealing a laptop are separate alternatives, so they should be OR branches, not AND branches. AND wrongly says both are needed.

Applying

Meanings

Term

attack tree

Meaning

A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives; AND branches are steps that are all needed.

Practice

GOAL: Take over a school account

Testing

Gaps

: Steal a student's exam results

Check Answer

Spots

2 OR: Guess the password

3 AND: Phish the login details

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Where does the attacker's goal go in an attack tree?

A. At the top of the tree (the root) ✓

B. At the bottom of the tree

An attack tree starts with the goal at the top. The branches below show the different ways to reach it.

2. What do the branches of an attack tree show?

A. The list of people who work at the company

B. Different ways to reach the attacker's goal ✓

Each branch is a path or step an attacker could use to get closer to the goal at the top.

3. Goal: Read a student's email. Branches: 'Guess the password' OR 'Trick them with a phishing message'. What does OR mean here?

A. Either branch alone is enough to reach the goal ✓

B. Both branches must happen to reach the goal

OR branches are alternatives. The attacker only needs to succeed with one of them.

4. Goal: Get into a locked server room. Branches: 'Steal a key card' AND 'Learn the PIN code'. What does AND mean here?

A. The attacker needs both steps to succeed ✓

B. The attacker can pick just one step

AND branches are steps that are all needed. If one step fails, the goal is not reached.

5. Which is a better description of an OR branch?

A. Steps that must all be completed in order to succeed

B. Alternative ways to get to the same goal ✓

OR gives the attacker a choice. AND is the one that needs every step.

Match the Pairs

Goal: Steal student's email account → The root of an attack tree: the attacker's goal sits at the top of the diagram

OR: Guess password / Phish password → Alternative branches: the attacker only needs ONE of these ways to reach the goal

An AND branch means every step must be completed before the attacker reaches the goal above it → AND: Get the Wi-Fi name + Crack the Wi-Fi password

An attack tree shows the attacker's goal at the top, then branches into the ways to reach it → Goal: Read private messages OR: Steal phone OR: Trick user into sharing login

Goal: Get into the school network AND: Guess a password AND: Steal a staff laptop → Guessing a password and stealing a laptop are separate alternatives, so they should be OR branches, not AND branches. AND wrongly says both are needed.

Goal: Unlock the phone OR: Get the phone OR: Enter the PIN → Getting the phone and entering the PIN are steps that must both happen, so they should be AND branches, not OR. OR wrongly says either one alone is enough.

Key Term

attack tree

A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives; AND branches are steps that are all needed.

Fill in the Blanks

1. GOAL: Steal a student's exam results OR: Guess a teacher's password OR: Trick a teacher with phishing

Hint: Type the keyword that labels the attacker's aim at the top of the tree.

2. GOAL: Get into a student account OR: Guess the password / use phishing

Hint: Type the keyword for a branch that offers alternative ways to reach the goal.

3. GOAL: Log in to an account with MFA AND: Steal the password and the MFA code

Hint: Type the keyword for a branch where both steps must be completed.

4. GOAL: Get into the school Wi-Fi OR: Guess the password # one is enough OR: Read it off a sticky note

Hint: Type how many OR branches the attacker needs to succeed.

5. GOAL: Enter the server room AND: Steal a pass # all steps needed AND: Get past the guard

Hint: Type the word describing how many AND steps must succeed.

Spot the Error

Question 1

A GOAL: Read a student's email

B OR: Guess the password

C AND: Phish the login details

Line C — Guessing the password and phishing are two alternative ways to reach the goal, so each is an OR branch. AND would wrongly mean the attacker must do both. It should be ' OR: Phish the login details'.

Question 2

A GOAL: Stop account theft

B OR: Guess the password

C OR: Phish the student

Line A — The top of an attack tree is the attacker's goal, not a defender's aim. Stopping theft is a defence. The root should be 'GOAL: Steal a student account'.

Question 3

A GOAL: Tailgate a staff member

B OR: Steal a staff key card

C OR: Tailgate a staff member

Line A — Tailgating is one way of reaching the goal, so it belongs on a branch below the root. The goal at the top is what the attacker wants: 'GOAL: Enter the server room'.

Question 4

A GOAL: Log in with MFA

B OR: Steal the password

C AND: Steal the phone code

Line B — To get past MFA the attacker needs both the password and the phone code. Steps that are all needed are AND branches, so this should be ' AND: Steal the password'.

Question 5

A GOAL: Hijack a gaming account

B OR: Turn on MFA

C OR: Phish the player

Line B — An attack tree shows the attacker's ways of reaching the goal. Turning on MFA is a defence, not an attack step. The branch should be an attacker action such as ' OR: Guess the password'.

Student with a class code? Join your class →