Deck 4: Trust and Threat Model

Question 1

3)In the Web trust model, the management of who to trust is essentially pushed down to the user level.

Answer 1

True

Question 2

12)The ____ trust model is a general trust model that applies in the areas of e-commerce, Web services, and peer-to-peer (P2P) systems.

A) distributed
B) reputation
C) strict hierarchy
D) web of trust

Answer 2

B

Question 3

17)A(n) ____ is a type of methodology commonly used to identify all the threats associated with a system.

A) attack pattern
B) qualitative assessment
C) quantitative assessment
D) attack tree

Answer 3

D

Question 4

5)All keys in PGP are stored in encrypted form.

Question 5

7)In a ____, the tree is structured as a shallow hierarchy where there is no subordinate CAs.

A) web of trust
B) Web hierarchy
C) distributed model
D) trusted issuer hierarchy

Question 6

11)PGP allows revocation on two levels: signature level and ____ level.

A) key
B) DN
C) certificate
D) user

Question 7

18)In an attack tree, each path tracing from the root node to a leaf node represents a unique way to achieve the goal of the attacker. This path is also called a(n) "____."

A) attack path
B) validation path
C) risk path
D) trust path

Question 8

14)____ risk is one that affects only individuals and not the entire organization.

A) Implicit
B) Marginal
C) Particular
D) Fundamental

Question 9

10)In PGP, ____ trust is established when a user trusts his or her own key pair.

A) marginal
B) complete
C) explicit
D) implicit

Question 10

19)Once a basic attack tree is completed, you can assign values to each leaf node. These values are often called ____.

A) weights
B) ranks
C) risk levels
D) indicators

Question 11

6)The ____ trust model is the most common trust model used by PKI.

A) strict hierarchy
B) distributed
C) Web
D) web of trust

Question 12

16)____ is a threat-rating system developed by Microsoft and is used to assess risk with great granularity.

A) Qualitative assessment
B) DREAD
C) Quantitative assessment
D) Risk-scaling

Question 13

9)In a ____ configuration, all peer trust anchors are potentially cross-certified among each other.

A) hub configuration
B) line configuration
C) mesh configuration
D) star configuration

Question 14

1)Trust by itself can be measured quantitatively.

Question 15

13)A(n) ____ risk is one that affects the entire organization or large numbers of persons or groups within the organization.

A) fundamental
B) particular
C) marginal
D) implicit

Question 16

20)____ speed up the overall development process by providing tested and proven development paradigms.

A) Attack patterns
B) Design patterns
C) Tree patterns
D) Attack trees

Question 17

4)The digital certificate used by PGP is equal to the standard X.509 certificate.

Question 18

15)____ assessment is a weighted risk measurement with input from various parties.

A) Qualitative
B) Quantitative
C) Marginal
D) ALE

Question 19

8)____ configurations connects each peer trust anchor to a hub.

A) Tree
B) Hub
C) Mesh
D) Line

Question 20

2)The strict hierarchy model is appropriate for every environment.

Question 21

34)Describe the strict hierarchy trust model.

Question 22

27)The term _________________________ is used to address the pair of forward and reverse certificates associated with a particular CA.

Question 23

40)What does DREAD stand for?

Question 24

36)Describe the Web trust model.

Question 25

31)______________________________ is a process of computing and assigning numeric values for each object being assessed.

Question 26

39)What are the steps involved in a quantitative assessment?

Question 27

37)What are the core assumptions for validation and trust in PGP?

Question 28

22)____ is a security vulnerability at the application level using a database.

A) Phishing
B) XSS
C) Cross-site scripting
D) SQL injection

Question 29

41)What are the possible damages caused by phishing?

Question 30

23)The goal of the ____ attacker is to inject a SQL query/command as an input, possibly via Web pages.

A) phishing
B) XSS
C) SQL injection
D) denial of service

Question 31

26)____ is a security vulnerability when malicious client-side script is injected into a Web application to gather sensitive user data.

A) Buffer overflow
B) Phishing
C) XSS
D) SQL injection

Question 32

38)What are some of the characteristics of a centralized system that implements a reputation trust model?

Question 33

30)_________________________ is an organizational process that identifies potential loss exposures and selects the most appropriate techniques for treating such exposures.

Question 34

35)What are the three variations of the distributed trust model?

Question 35

21)____ is a form of social engineering, characterized by attempts to fraudulently acquire sensitive information by posing as a trustworthy person or business in an apparently official electronic communication.

A) Cross-site scripting
B) Denial of service
C) Phishing
D) SQL injection

Question 36

25)A ____ policy prevents a document or script loaded from one "origin" from accessing or modifying the properties of a document from a different "origin."

A) same-origin
B) trust domain
C) cross-certification
D) cross-domain

Question 37

29)____________________ is a security-analysis methodology that can be used to identify risks and to guide subsequent software development decisions.

Question 38

33)How is trust defined?

Question 39

24)The original definition of ____ is a software security vulnerability in Web applications that can be used by an attacker to compromise the same origin policy of client-side scripting languages.

A) denial of service
B) cross-site scripting
C) phishing
D) SQL injection

Question 40

28)______________________________ is the best implementation of the web of trust model.

Question 42

42)What are the possible damages caused by a cross-site scripting attack?