← ACARA Digital Technologies Years 9–10

Choosing access controls for a scenario

Naming the data to protect, then choosing controls like login, permissions, a firewall or encryption, and justifying each one with the risk it reduces.

Part of: ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 148, WA Computer Science ATAR Year 11 — Network Communications — Module 135

Understanding Choosing access controls for a scenario in ACARA Digital Technologies Years 9–10

What it does: The word 'because' connects the chosen control (firewall) to the risk (unauthorised access), which is how a justification is written. Using several controls together means if one fails, such as a stolen password, the others still protect the shop's data. Good access control starts by naming the data (the asset). Then you pick controls that reduce the risks to that data. A stolen laptop is a risk to data at rest. Encryption keeps the data unreadable. A firewall rule on port 80 does nothing for a stolen device. Permissions limit what each user can do. Read-only means students can view the notes but not edit or delete them, which reduces the risk of tampering.

Common mistakes: A bigger monitor does nothing to stop outsiders reaching the server. The control must match the risk, so it should be 'control: firewall'. Encryption does not stop a laptop being stolen. It makes the data unreadable to the thief, so the line should be 'because: thief cannot read it'.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Choosing access controls for a scenario to a class →

This module's key terms are also in a printable crossword (Modules 116–154) and word search (Modules 116–225).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A school wants to protect student reports stored on its network. What should it do FIRST?

Name the data to protect (student reports), then choose controls for itBuy a firewall and hope it covers everything

Matches

School network: install a firewall. (no data or risk named)

↓

The control is chosen without naming the data to protect or the risk it reduces, so there is no justification.

Applying

Meanings

Term

access control

Meaning

Naming the data to protect, then choosing controls like login, permissions, a firewall or encryption, and justifying each one with the risk it reduces.

Practice

SYSTEM: school network

Testing

Gaps

Control: (read-only for students)

Check Answer

Spots

1asset: student records

2control: bigger monitor

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A school wants to protect student reports stored on its network. What should it do FIRST?

A. Buy a firewall and hope it covers everything

B. Name the data to protect (student reports), then choose controls for it ✓

Good access control starts by naming the data (the asset). Then you pick controls that reduce the risks to that data.

2. Which justification links a control to a risk?

A. Use MFA on teacher accounts because a stolen password could let someone view marks ✓

B. Use MFA on teacher accounts because it is a good thing to have

A strong justification uses 'because' and names the risk the control reduces. Vague reasons do not link to a risk.

3. A small business stores customer credit card details. Which control best protects them if a laptop is stolen?

A. Add a firewall rule that blocks port 80

B. Encrypt the stored data so it cannot be read without the key ✓

A stolen laptop is a risk to data at rest. Encryption keeps the data unreadable. A firewall rule on port 80 does nothing for a stolen device.

4. In a school network, students should only read the class notes folder, not change it. Which control fits?

A. Give students read-only permission on that folder ✓

B. Give students read, write and execute permission

Permissions limit what each user can do. Read-only means students can view the notes but not edit or delete them, which reduces the risk of tampering.

5. A small business runs a web server for online orders. Which firewall rule suits it?

A. Allow web traffic on the ports it needs and deny everything else ✓

B. Allow all traffic so customers never get blocked

A firewall should allow only what the system needs. Denying the rest reduces the risk of unauthorised network access.

Match the Pairs

Data: student marks | Control: permissions (read only for students) → Names the data to protect, then picks a control that stops students from changing their own marks

Data: customer card details | Control: encryption → Names the data to protect, then picks a control that keeps it unreadable if someone intercepts or steals it

A control is justified with 'because' by linking it to the risk it reduces → Use a firewall BECAUSE it blocks unauthorised traffic from the internet reaching the school network

Layering several controls means one failure does not expose the data → Small shop: login + multi-factor + firewall + encrypted backups

School network: install a firewall. (no data or risk named) → The control is chosen without naming the data to protect or the risk it reduces, so there is no justification.

Small business: one strong password protects everything, so no other controls are needed. → Relies on a single control. If the password is stolen or guessed, all of the data is exposed.

Key Term

access control

Naming the data to protect, then choosing controls like login, permissions, a firewall or encryption, and justifying each one with the risk it reduces.

Fill in the Blanks

1. Data: student grades Risk: students could change marks Control: permissions (read-only for students)

Hint: Type the control that sets what each user is allowed to view or change.

2. Data: customer card details Risk: card numbers read in transit Control: encryption scrambles the data

Hint: Type the control that scrambles data so an interceptor cannot read it.

3. Risk: attackers scan the shop network Use a firewall because it blocks attackers

Hint: Type the word that links a chosen control to the reason for it.

4. Layer 1: password login (who you are) Layer 2: permissions (what you can do)

Hint: Type the control that limits what a logged-in user can do.

5. Data: staff payroll files Risk: passwords can be guessed Control: multi-factor login stops guessing

Hint: Type the label for the first step: naming what needs protecting.

Spot the Error

Question 1

A asset: student records

B control: bigger monitor

C risk: outsiders reach server

D because: it blocks outsiders

Line B — A bigger monitor does nothing to stop outsiders reaching the server. The control must match the risk, so it should be 'control: firewall'.

Question 2

A asset: customer card details

B risk: laptop could be stolen

C control: encryption

D because: it prevents theft

Line D — Encryption does not stop a laptop being stolen. It makes the data unreadable to the thief, so the line should be 'because: thief cannot read it'.

Question 3

A IF role = student THEN

B allow read of marks

C allow write to marks

D END IF

Line C — Students should only be able to read marks, not change them. Least privilege means line 3 should be 'deny write to marks'.

Question 4

A asset: classroom posters

B risk: students open the file

C control: login with password

D because: it proves who you are

Line A — The asset is the data that needs protecting. The risk and control are about the payroll file, so line 1 should be 'asset: staff payroll file'.

Question 5

A asset: online shop orders

B control 1: password login

C control 2: firewall

D control 3: HTTP, no encryption

E because: layers cover gaps

Line D — HTTP sends data as plaintext, so it adds no protection. A third layer that protects data in transit should be HTTPS encryption.

Student with a class code? Join your class →