Choosing access controls for a scenario

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A school wants to protect student reports stored on its network. What should it do FIRST?

A Buy a firewall and hope it covers everything

B Name the data to protect (student reports), then choose controls for it

2. Which justification links a control to a risk?

A Use MFA on teacher accounts because a stolen password could let someone view marks

B Use MFA on teacher accounts because it is a good thing to have

3. A small business stores customer credit card details. Which control best protects them if a laptop is stolen?

A Add a firewall rule that blocks port 80

B Encrypt the stored data so it cannot be read without the key

4. In a school network, students should only read the class notes folder, not change it. Which control fits?

A Give students read-only permission on that folder

B Give students read, write and execute permission

5. A small business runs a web server for online orders. Which firewall rule suits it?

A Allow web traffic on the ports it needs and deny everything else

B Allow all traffic so customers never get blocked

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Data: student marks \| Control: permissions (read only for students)		ANames the data to protect, then picks a control that keeps it unreadable if someone intercepts or steals it
2Data: customer card details \| Control: encryption		BRelies on a single control. If the password is stolen or guessed, all of the data is exposed.
3A control is justified with 'because' by linking it to the risk it reduces		CNames the data to protect, then picks a control that stops students from changing their own marks
4Layering several controls means one failure does not expose the data		DUse a firewall BECAUSE it blocks unauthorised traffic from the internet reaching the school network
5School network: install a firewall. (no data or risk named)		EThe control is chosen without naming the data to protect or the risk it reduces, so there is no justification.
6Small business: one strong password protects everything, so no other controls are needed.		FSmall shop: login + multi-factor + firewall + encrypted backups

Definitions

access control

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Data: student grades Risk: students could change marks Control: ___________ (read-only for students)

Data: customer card details Risk: card numbers read in transit Control: __________ scrambles the data

Risk: attackers scan the shop network Use a firewall _______ it blocks attackers

Layer 1: password login (who you are) Layer 2: ___________ (what you can do)

____: staff payroll files Risk: passwords can be guessed Control: multi-factor login stops guessing

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A asset: student records

B control: bigger monitor

C risk: outsiders reach server

D because: it blocks outsiders

Question 2

A asset: customer card details

B risk: laptop could be stolen

C control: encryption

D because: it prevents theft

Question 3

A IF role = student THEN

B allow read of marks

C allow write to marks

D END IF

Question 4

A asset: classroom posters

B risk: students open the file

C control: login with password

D because: it proves who you are

Question 5

A asset: online shop orders

B control 1: password login

C control 2: firewall

D control 3: HTTP, no encryption

E because: layers cover gaps

Answer Key

Choosing access controls for a scenario

Section A: Quick Questions

B — Name the data to protect (student reports), then choose controls for it

A — Use MFA on teacher accounts because a stolen password could let someone view marks

B — Encrypt the stored data so it cannot be read without the key

A — Give students read-only permission on that folder

A — Allow web traffic on the ports it needs and deny everything else

Section B: Match the Pairs

Data: student marks | Control: permissions (read only for students) → Names the data to protect, then picks a control that stops students from changing their own marks

Data: customer card details | Control: encryption → Names the data to protect, then picks a control that keeps it unreadable if someone intercepts or steals it

A control is justified with 'because' by linking it to the risk it reduces → Use a firewall BECAUSE it blocks unauthorised traffic from the internet reaching the school network

Layering several controls means one failure does not expose the data → Small shop: login + multi-factor + firewall + encrypted backups

School network: install a firewall. (no data or risk named) → The control is chosen without naming the data to protect or the risk it reduces, so there is no justification.

Small business: one strong password protects everything, so no other controls are needed. → Relies on a single control. If the password is stolen or guessed, all of the data is exposed.

Section C: Definitions

access control — Naming the data to protect, then choosing controls like login, permissions, a firewall or encryption, and justifying each one with the risk it reduces.

Section D: Fill in the Blanks

Data: student grades
Risk: students could change marks
Control: permissions (read-only for students)

Data: customer card details
Risk: card numbers read in transit
Control: encryption scrambles the data

Risk: attackers scan the shop network
Use a firewall because it blocks attackers

Layer 1: password login (who you are)
Layer 2: permissions (what you can do)

Data: staff payroll files
Risk: passwords can be guessed
Control: multi-factor login stops guessing

Section E: Spot the Error

B — A bigger monitor does nothing to stop outsiders reaching the server. The control must match the risk, so it should be 'control: firewall'.

D — Encryption does not stop a laptop being stolen. It makes the data unreadable to the thief, so the line should be 'because: thief cannot read it'.

C — Students should only be able to read marks, not change them. Least privilege means line 3 should be 'deny write to marks'.

A — The asset is the data that needs protecting. The risk and control are about the payroll file, so line 1 should be 'asset: staff payroll file'.

D — HTTP sends data as plaintext, so it adds no protection. A third layer that protects data in transit should be HTTPS encryption.