Which STRIDE category covers impersonating a TA identity to gain unauthorized access to a trust domain?

• A. Spoofing
• B. Tampering
• C. Repudiation
• D. Information Disclosure

Answer: (A)

Spoofing is about pretending to be someone else to gain access to systems or resources. Impersonating a TA to enter a trust domain is exactly forging an identity to fool authentication, which is the essence of spoofing. In STRIDE, this category covers identity-based attacks where an attacker presents forged credentials or a false identity to convince the system they are trusted. Gaining unauthorized access by acting as the TA is a classic example of identity forgery, so it fits spoofing best. Tampering would be about altering data, repudiation concerns denying actions after the fact, and information disclosure involves leaking data; none of these describe the act of masquerading as a trusted entity to breach access.