← VCE Data Analytics U4O2

Adaptive (risk-based) authentication

Login checks that change with risk signals like location, device or time. A known device gets an easy login; an unusual location triggers extra proof.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 44, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 110

Understanding Adaptive (risk-based) authentication in VCE Data Analytics U4O2

What it does: The code combines the three risk signals into one score that can decide how much proof is needed. A high risk score triggers a step-up check, so the strength of authentication scales with the risk. A known device and normal pattern are low risk signals, so the login stays easy. An unusual location is a risk signal, so the system asks for extra proof to confirm the user's identity. Recognising a trusted device reduces the risk rating, so fewer extra checks are needed. It does not change the password. It is an emerging authentication trend because it uses context, such as location, device and time, rather than one fixed set of checks.

Common mistakes: Adaptive authentication adds risk when the location is unusual. The test should be location ≠ usual. As written, a normal location raises the risk and an unusual one does not. A known device lowers friction, so it should get the easy login. The test should be device = known. As written, unknown devices get the easy login and known devices get extra checks.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Adaptive (risk-based) authentication to a class →

This module's key terms are also in a printable crossword (Modules 44–79) and word search (Modules 44–113).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A student logs in from their usual laptop at home at 4pm. What does adaptive authentication most likely do?
Demands every possible extra check before allowing accessAllows a low-friction login, such as just a password
Matches
Every login from every user always gets the same fixed checks, whatever the location, device or time
↓
This is static authentication, not adaptive. Adaptive authentication changes the checks according to risk signals.
Applying
Meanings
Term
Adaptive authentication
Meaning
Login checks that change with risk signals like location, device or time. A known device gets an easy login; an unusual location triggers extra proof.
Practice
risk <- 0
Testing
Gaps
IF loginLocation usualLocation THEN
Check Answer
Spots
1risk ← 0
2IF location = usual THEN

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Reindeer' badge — Dictionary Guide, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A student logs in from their usual laptop at home at 4pm. What does adaptive authentication most likely do?
A. Allows a low-friction login, such as just a password ✓
B. Demands every possible extra check before allowing access
A known device and normal pattern are low risk signals, so the login stays easy.
2. Which statement describes adaptive authentication correctly?
A. The amount of proof required changes with the risk of each login ✓
B. Every user must give the same proof every time they log in
Adaptive (risk-based) authentication adjusts the checks to match the risk signals of each login attempt.
3. An employee who always logs in from Melbourne suddenly tries to log in from another country. What happens under adaptive authentication?
A. An extra check is triggered, such as a code sent to their phone ✓
B. The system ignores the location and treats it as normal
An unusual location is a risk signal, so the system asks for extra proof to confirm the user's identity.
4. Which of these is a risk signal that adaptive authentication might use?
A. The font size used on the login page
B. The time of day the login is attempted ✓
Location, device and time are common risk signals. Font size says nothing about whether the login is legitimate.
5. Why does a known device lower friction for the user?
A. The device makes the password stronger automatically
B. The system recognises the device, so the login is seen as lower risk ✓
Recognising a trusted device reduces the risk rating, so fewer extra checks are needed. It does not change the password.

Match the Pairs

if location != usual_location: require_mfa() → An unusual location triggers an extra check, so the user must give more proof before access is granted
if device_id in trusted_devices: allow_login() → A known device lowers friction, so the user gets a simple login with no extra steps
Adaptive authentication scores the risk of each login using signals such as location, device and time → risk = score(location, device, time)
The higher the risk score, the more proof the login needs (a step-up check) → if risk > 70: ask_for_second_factor()
Every login from every user always gets the same fixed checks, whatever the location, device or time → This is static authentication, not adaptive. Adaptive authentication changes the checks according to risk signals.
if login_from_new_country: skip_all_checks() → A login from an unusual location is a higher risk, so it should trigger extra checks and not skip them.

Key Term

Adaptive authentication
Login checks that change with risk signals like location, device or time. A known device gets an easy login; an unusual location triggers extra proof.

Fill in the Blanks

1. IF loginLocation != usualLocation THEN requireMFA() ENDIF
Hint: Type the comparison operator that checks two values are not equal, so an unusual location triggers extra proof.
2. IF deviceKnown = TRUE THEN allowLogin() ELSE requireMFA()
Hint: Type the keyword that runs the other branch when the device is not recognised.
3. risk ← 0 IF newLocation THEN risk ← risk + 40 ENDIF
Hint: Type the arithmetic operator that raises the risk score when a risk signal is found.
4. IF riskScore >= 70 THEN requireMFA() ENDIF
Hint: Type the comparison operator meaning at or above the high-risk threshold.
5. IF loginHour < 6 OR loginHour > 22 THEN requireMFA() ENDIF
Hint: Type the logical operator so that either unusual login time triggers the extra check.

Spot the Error

Question 1
A risk ← 0
B IF location = usual THEN
C risk ← risk + 40
D END IF
Line B — Adaptive authentication adds risk when the location is unusual. The test should be location ≠ usual. As written, a normal location raises the risk and an unusual one does not.
Question 2
A IF device ≠ known THEN
B require password only
C ELSE
D require password + code
E END IF
Line A — A known device lowers friction, so it should get the easy login. The test should be device = known. As written, unknown devices get the easy login and known devices get extra checks.
Question 3
A risk ← 0
B IF device ≠ known: risk ← 30
C IF location ≠ usual: risk ← 40
D IF risk > 40 THEN
E ask for extra proof
Line D — The check should be risk >= 40. With > 40, a login from an unusual location alone scores exactly 40 and is never challenged for extra proof.
Question 4
A IF risk = high THEN
B allow password login
C ELSE
D ask for extra proof
Line A — Low-risk logins get the simple password login and higher risk gets extra proof. The test should be risk = low. As written, the logic is reversed and high-risk logins get the easy path.
Question 5
A device ← get_device()
B IF device NOT IN trusted THEN
C skip extra check
D ELSE
E ask for code
F END IF
Line B — The extra check should be skipped for trusted (known) devices. It should read IF device IN trusted. With NOT IN, known devices are challenged and unknown devices skip the check.

Student with a class code? Join your class →