Which concept refers to a hierarchical data structure that displays approaches to penetrate a system’s security?

• A. Access Control List
• B. Vulnerability Report
• C. Attack Tree
• D. Risk Assessment

Answer: (C)

The concept that refers to a hierarchical data structure displaying approaches to penetrate a system's security is known as an Attack Tree. An Attack Tree is utilized in security analysis to visualize various attack paths or strategies that an adversary might employ to compromise a system. Each node of the tree represents a different attack method or sub-goal that contributes to the overall goal of compromising the system.

This structure allows security professionals to systematically evaluate and prioritize risks, thereby identifying the most effective security measures to implement in order to protect against potential threats. By organizing attack strategies in a tree format, it becomes easier to analyze vulnerabilities and understand how they might be exploited.

Access Control Lists are mechanisms used to define which users or system processes have permission to access certain resources, rather than outlining methods to breach security. A Vulnerability Report catalogues specific vulnerabilities found during an assessment, providing details on each but not structuring them hierarchically in the manner that an Attack Tree does. Risk Assessment, on the other hand, involves evaluating the potential risks in a system, focusing on identifying and mitigating them, rather than specifically detailing attack methods in a structured way as an Attack Tree does.