Attack trees

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Where does the attacker's goal go in an attack tree?

A At the top of the tree (the root)

B At the bottom of the tree

2. What do the branches of an attack tree show?

A The list of people who work at the company

B Different ways to reach the attacker's goal

3. Goal: Read a student's email. Branches: 'Guess the password' OR 'Trick them with a phishing message'. What does OR mean here?

A Either branch alone is enough to reach the goal

B Both branches must happen to reach the goal

4. Goal: Get into a locked server room. Branches: 'Steal a key card' AND 'Learn the PIN code'. What does AND mean here?

A The attacker needs both steps to succeed

B The attacker can pick just one step

5. Which is a better description of an OR branch?

A Steps that must all be completed in order to succeed

B Alternative ways to get to the same goal

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Goal: Steal student's email account		AGuessing a password and stealing a laptop are separate alternatives, so they should be OR branches, not AND branches. AND wrongly says both are needed.
2OR: Guess password / Phish password		BGetting the phone and entering the PIN are steps that must both happen, so they should be AND branches, not OR. OR wrongly says either one alone is enough.
3An AND branch means every step must be completed before the attacker reaches the goal above it		CThe root of an attack tree: the attacker's goal sits at the top of the diagram
4An attack tree shows the attacker's goal at the top, then branches into the ways to reach it		DAlternative branches: the attacker only needs ONE of these ways to reach the goal
5Goal: Get into the school network AND: Guess a password AND: Steal a staff laptop		EAND: Get the Wi-Fi name + Crack the Wi-Fi password
6Goal: Unlock the phone OR: Get the phone OR: Enter the PIN		FGoal: Read private messages OR: Steal phone OR: Trick user into sharing login

Definitions

attack tree

Fill in the Blanks

Complete each line of code by filling in the missing parts.

____: Steal a student's exam results OR: Guess a teacher's password OR: Trick a teacher with phishing

GOAL: Get into a student account __: Guess the password / use phishing

GOAL: Log in to an account with MFA ___: Steal the password and the MFA code

GOAL: Get into the school Wi-Fi OR: Guess the password # ___ is enough OR: Read it off a sticky note

GOAL: Enter the server room AND: Steal a pass # ___ steps needed AND: Get past the guard

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A GOAL: Read a student's email

B OR: Guess the password

C AND: Phish the login details

Question 2

A GOAL: Stop account theft

B OR: Guess the password

C OR: Phish the student

Question 3

A GOAL: Tailgate a staff member

B OR: Steal a staff key card

C OR: Tailgate a staff member

Question 4

A GOAL: Log in with MFA

B OR: Steal the password

C AND: Steal the phone code

Question 5

A GOAL: Hijack a gaming account

B OR: Turn on MFA

C OR: Phish the player

Answer Key

Attack trees

Section A: Quick Questions

A — At the top of the tree (the root)

B — Different ways to reach the attacker's goal

A — Either branch alone is enough to reach the goal

A — The attacker needs both steps to succeed

B — Alternative ways to get to the same goal

Section B: Match the Pairs

Goal: Steal student's email account → The root of an attack tree: the attacker's goal sits at the top of the diagram

OR: Guess password / Phish password → Alternative branches: the attacker only needs ONE of these ways to reach the goal

An AND branch means every step must be completed before the attacker reaches the goal above it → AND: Get the Wi-Fi name + Crack the Wi-Fi password

An attack tree shows the attacker's goal at the top, then branches into the ways to reach it → Goal: Read private messages OR: Steal phone OR: Trick user into sharing login

Goal: Get into the school network AND: Guess a password AND: Steal a staff laptop → Guessing a password and stealing a laptop are separate alternatives, so they should be OR branches, not AND branches. AND wrongly says both are needed.

Goal: Unlock the phone OR: Get the phone OR: Enter the PIN → Getting the phone and entering the PIN are steps that must both happen, so they should be AND branches, not OR. OR wrongly says either one alone is enough.

Section C: Definitions

attack tree — A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives; AND branches are steps that are all needed.

Section D: Fill in the Blanks

GOAL: Steal a student's exam results
  OR: Guess a teacher's password
  OR: Trick a teacher with phishing

GOAL: Get into a student account
  OR: Guess the password / use phishing

GOAL: Log in to an account with MFA
  AND: Steal the password and the MFA code

GOAL: Get into the school Wi-Fi
  OR: Guess the password  # one is enough
  OR: Read it off a sticky note

GOAL: Enter the server room
  AND: Steal a pass  # all steps needed
  AND: Get past the guard

Section E: Spot the Error

C — Guessing the password and phishing are two alternative ways to reach the goal, so each is an OR branch. AND would wrongly mean the attacker must do both. It should be ' OR: Phish the login details'.

A — The top of an attack tree is the attacker's goal, not a defender's aim. Stopping theft is a defence. The root should be 'GOAL: Steal a student account'.

A — Tailgating is one way of reaching the goal, so it belongs on a branch below the root. The goal at the top is what the attacker wants: 'GOAL: Enter the server room'.

B — To get past MFA the attacker needs both the password and the phone code. Steps that are all needed are AND branches, so this should be ' AND: Steal the password'.

B — An attack tree shows the attacker's ways of reaching the goal. Turning on MFA is a defence, not an attack step. The branch should be an attacker action such as ' OR: Guess the password'.