Question 1

Describe the strict hierarchy trust model.

Accepted Answer

In a strict hierarchy trust model, there is one trust anchor (root) from which trust extends. The root is not a starting point for a network, for communication, or for architecture; it is a starting point of trust. Zero or more subordinate trust anchors could extend from the root downward, and the leaves representing end entities are at the bottom. We can consider the model as a big trust tree. Subordinate trust anchors may certify trust in themselves, or they may certify yet other subordinate trust anchors that certify trust in turn. The leaf, or end entity's, trust is verified by tracing backward from its certifier to other subordinate trust anchors until the root is found.

Question 2

Once a basic attack tree is completed, you can assign values to each leaf node. These values are often called ____.

Accepted Answer

A)  weights 
B)  ranks 
C)  risk levels 
D)  indicators 
A)  weights 
B)  ranks 
C)  risk levels 
D)  indicators D

Question 3

In a ____, the tree is structured as a shallow hierarchy where there is no subordinate CAs.

Accepted Answer

A)  web of trust 
B)  Web hierarchy 
C)  distributed model 
D)  trusted issuer hierarchy 
A)  web of trust 
B)  Web hierarchy 
C)  distributed model 
D)  trusted issuer hierarchy D

Question 4

____ speed up the overall development process by providing tested and proven development paradigms.

Accepted Answer

A)  Attack patterns 
B)  Design patterns 
C)  Tree patterns 
D)  Attack trees 
A)  Attack patterns 
B)  Design patterns 
C)  Tree patterns 
D)  Attack trees

Question 5

What are the three variations of the distributed trust model?

Accepted Answer

There are three variations of this model

Question 6

The original definition of ____ is a software security vulnerability in Web applications that can be used by an attacker to compromise the same origin policy of client-side scripting languages.

Accepted Answer

A)  denial of service 
B)  cross-site scripting 
C)  phishing 
D)  SQL injection 
A)  denial of service 
B)  cross-site scripting 
C)  phishing 
D)  SQL injection

Question 7

The goal of the ____ attacker is to inject a SQL query/command as an input, possibly via Web pages.

Accepted Answer

A)  phishing 
B)  XSS 
C)  SQL injection 
D)  denial of service 
A)  phishing 
B)  XSS 
C)  SQL injection 
D)  denial of service

Question 8

In an attack tree, each path tracing from the root node to a leaf node represents a unique way to achieve the goal of the attacker. This path is also called a(n) "____."

Accepted Answer

A)  attack path 
B)  validation path 
C)  risk path 
D)  trust path 
A)  attack path 
B)  validation path 
C)  risk path 
D)  trust path

Question 9

____ is a security vulnerability when malicious client-side script is injected into a Web application to gather sensitive user data.

Accepted Answer

A)  Buffer overflow 
B)  Phishing 
C)  XSS 
D)  SQL injection 
A)  Buffer overflow 
B)  Phishing 
C)  XSS 
D)  SQL injection

Question 10

The ____ trust model is a general trust model that applies in the areas of e-commerce, Web services, and peer-to-peer (P2P) systems.

Accepted Answer

A)  distributed 
B)  reputation 
C)  strict hierarchy 
D)  web of trust 
A)  distributed 
B)  reputation 
C)  strict hierarchy 
D)  web of trust

Question 11

What are the steps involved in a quantitative assessment?

Accepted Answer

A quantitative assessment follows the fo

Question 12

______________________________ is the best implementation of the web of trust model.

Accepted Answer

PGP (Pretty good pri

Question 13

Trust by itself can be measured quantitatively.

Accepted Answer

A) True 
 B)False

Question 14

Match between columns
                        Premises: process of connecting the peer trust anchors in a distributed trust model
provides a formal way of describing the security of systems based on various attacks
decentralizes the task of trust management to the users
defines what you can trust, how you are going to build a trust relationship, and when to apply and verify the trust
standard solutions to common problems in software design
the most popular PKI trust model used today
sometimes referred as organizational survey assessment
uncertainty concerning the occurrence of a loss
speed up security analysis by providing tested and proven problem/solution pairs

Accepted Answer

The Answer of Attack tree and Trust model and Web is...

Question 15

____ is a threat-rating system developed by Microsoft and is used to assess risk with great granularity.

Accepted Answer

A)  Qualitative assessment 
B)  DREAD 
C)  Quantitative assessment 
D)  Risk-scaling 
A)  Qualitative assessment 
B)  DREAD 
C)  Quantitative assessment 
D)  Risk-scaling

Question 16

The digital certificate used by PGP is equal to the standard X.509 certificate.

Accepted Answer

A) True 
 B)False

Question 17

____ is a security vulnerability at the application level using a database.

Accepted Answer

A)  Phishing 
B)  XSS 
C)  Cross-site scripting 
D)  SQL injection 
A)  Phishing 
B)  XSS 
C)  Cross-site scripting 
D)  SQL injection

Question 18

What are some of the characteristics of a centralized system that implements a reputation trust model?

Accepted Answer

The characteristics of a centralized sys

Question 19

____ risk is one that affects only individuals and not the entire organization.

Accepted Answer

A)  Implicit 
B)  Marginal 
C)  Particular 
D)  Fundamental 
A)  Implicit 
B)  Marginal 
C)  Particular 
D)  Fundamental

Question 20

What does DREAD stand for?

Accepted Answer

DREAD is an acronym of the five key attr

Describe the strict hierarchy trust model.

Once a basic attack tree is completed, you can assign values to each leaf node. These values are often called ____.

In a ____, the tree is structured as a shallow hierarchy where there is no subordinate CAs.

____ speed up the overall development process by providing tested and proven development paradigms.

What are the three variations of the distributed trust model?

The original definition of ____ is a software security vulnerability in Web applications that can be used by an attacker to compromise the same origin policy of client-side scripting languages.

The goal of the ____ attacker is to inject a SQL query/command as an input, possibly via Web pages.

In an attack tree, each path tracing from the root node to a leaf node represents a unique way to achieve the goal of the attacker. This path is also called a(n) "____."

____ is a security vulnerability when malicious client-side script is injected into a Web application to gather sensitive user data.

The ____ trust model is a general trust model that applies in the areas of e-commerce, Web services, and peer-to-peer (P2P) systems.

What are the steps involved in a quantitative assessment?

______________________________ is the best implementation of the web of trust model.

Trust by itself can be measured quantitatively.

____ is a threat-rating system developed by Microsoft and is used to assess risk with great granularity.

The digital certificate used by PGP is equal to the standard X.509 certificate.

____ is a security vulnerability at the application level using a database.

What are some of the characteristics of a centralized system that implements a reputation trust model?

____ risk is one that affects only individuals and not the entire organization.

What does DREAD stand for?

Introduction to Security Concepts

Software Engineering and Security

Essential Public Key Infrastructure

Java Programming Security

Java Api-Level Security Features

Authentication and Authorization With Java

Secure Programming With C and Openssl

Secure Programming With Perl

Identity Management

Security Topics

Filters

Exam 4: Trust and Threat Model

Describe the strict hierarchy trust model.

Once a basic attack tree is completed, you can assign values to each leaf node. These values are often called ____.

In a ____, the tree is structured as a shallow hierarchy where there is no subordinate CAs.

____ speed up the overall development process by providing tested and proven development paradigms.

What are the three variations of the distributed trust model?

The original definition of ____ is a software security vulnerability in Web applications that can be used by an attacker to compromise the same origin policy of client-side scripting languages.

The goal of the ____ attacker is to inject a SQL query/command as an input, possibly via Web pages.

In an attack tree, each path tracing from the root node to a leaf node represents a unique way to achieve the goal of the attacker. This path is also called a(n) "____."

____ is a security vulnerability when malicious client-side script is injected into a Web application to gather sensitive user data.

The ____ trust model is a general trust model that applies in the areas of e-commerce, Web services, and peer-to-peer (P2P) systems.

What are the steps involved in a quantitative assessment?

______________________________ is the best implementation of the web of trust model.

Trust by itself can be measured quantitatively.

____ is a threat-rating system developed by Microsoft and is used to assess risk with great granularity.

The digital certificate used by PGP is equal to the standard X.509 certificate.

____ is a security vulnerability at the application level using a database.

What are some of the characteristics of a centralized system that implements a reputation trust model?

____ risk is one that affects only individuals and not the entire organization.

What does DREAD stand for?

Introduction to Security Concepts

Software Engineering and Security

Essential Public Key Infrastructure

Java Programming Security

Java Api-Level Security Features

Authentication and Authorization With Java

Secure Programming With C and Openssl

Secure Programming With Perl

Identity Management

Security Topics

Filters