Adaptive (risk-based) authentication

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A student logs in from their usual laptop at home at 4pm. What does adaptive authentication most likely do?

A Allows a low-friction login, such as just a password

B Demands every possible extra check before allowing access

2. Which statement describes adaptive authentication correctly?

A The amount of proof required changes with the risk of each login

B Every user must give the same proof every time they log in

3. An employee who always logs in from Melbourne suddenly tries to log in from another country. What happens under adaptive authentication?

A An extra check is triggered, such as a code sent to their phone

B The system ignores the location and treats it as normal

4. Which of these is a risk signal that adaptive authentication might use?

A The font size used on the login page

B The time of day the login is attempted

5. Why does a known device lower friction for the user?

A The device makes the password stronger automatically

B The system recognises the device, so the login is seen as lower risk

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1if location != usual_location: require_mfa()		Aif risk > 70: ask_for_second_factor()
2if device_id in trusted_devices: allow_login()		BA known device lowers friction, so the user gets a simple login with no extra steps
3Adaptive authentication scores the risk of each login using signals such as location, device and time		Crisk = score(location, device, time)
4The higher the risk score, the more proof the login needs (a step-up check)		DThis is static authentication, not adaptive. Adaptive authentication changes the checks according to risk signals.
5Every login from every user always gets the same fixed checks, whatever the location, device or time		EAn unusual location triggers an extra check, so the user must give more proof before access is granted
6if login_from_new_country: skip_all_checks()		FA login from an unusual location is a higher risk, so it should trigger extra checks and not skip them.

Definitions

Adaptive authentication

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF loginLocation __ usualLocation THEN requireMFA() ENDIF

IF deviceKnown = TRUE THEN allowLogin() ____ requireMFA()

risk ← 0 IF newLocation THEN risk ← risk _ 40 ENDIF

IF riskScore __ 70 THEN requireMFA() ENDIF

IF loginHour < 6 __ loginHour > 22 THEN requireMFA() ENDIF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A risk ← 0

B IF location = usual THEN

C risk ← risk + 40

D END IF

Question 2

A IF device ≠ known THEN

B require password only

C ELSE

D require password + code

E END IF

Question 3

A risk ← 0

B IF device ≠ known: risk ← 30

C IF location ≠ usual: risk ← 40

D IF risk > 40 THEN

E ask for extra proof

Question 4

A IF risk = high THEN

B allow password login

C ELSE

D ask for extra proof

Question 5

A device ← get_device()

B IF device NOT IN trusted THEN

C skip extra check

D ELSE

E ask for code

F END IF

Answer Key

Adaptive (risk-based) authentication

Section A: Quick Questions

A — Allows a low-friction login, such as just a password

A — The amount of proof required changes with the risk of each login

A — An extra check is triggered, such as a code sent to their phone

B — The time of day the login is attempted

B — The system recognises the device, so the login is seen as lower risk

Section B: Match the Pairs

if location != usual_location: require_mfa() → An unusual location triggers an extra check, so the user must give more proof before access is granted

if device_id in trusted_devices: allow_login() → A known device lowers friction, so the user gets a simple login with no extra steps

Adaptive authentication scores the risk of each login using signals such as location, device and time → risk = score(location, device, time)

The higher the risk score, the more proof the login needs (a step-up check) → if risk > 70: ask_for_second_factor()

Every login from every user always gets the same fixed checks, whatever the location, device or time → This is static authentication, not adaptive. Adaptive authentication changes the checks according to risk signals.

if login_from_new_country: skip_all_checks() → A login from an unusual location is a higher risk, so it should trigger extra checks and not skip them.

Section C: Definitions

Adaptive authentication — Login checks that change with risk signals like location, device or time. A known device gets an easy login; an unusual location triggers extra proof.

Section D: Fill in the Blanks

IF loginLocation != usualLocation THEN
    requireMFA()
ENDIF

IF deviceKnown = TRUE THEN allowLogin()
ELSE requireMFA()

risk ← 0
IF newLocation THEN risk ← risk + 40
ENDIF

IF riskScore >= 70 THEN
    requireMFA()
ENDIF

IF loginHour < 6 OR loginHour > 22 THEN
    requireMFA()
ENDIF

Section E: Spot the Error

B — Adaptive authentication adds risk when the location is unusual. The test should be location ≠ usual. As written, a normal location raises the risk and an unusual one does not.

A — A known device lowers friction, so it should get the easy login. The test should be device = known. As written, unknown devices get the easy login and known devices get extra checks.

D — The check should be risk >= 40. With > 40, a login from an unusual location alone scores exactly 40 and is never challenged for extra proof.

A — Low-risk logins get the simple password login and higher risk gets extra proof. The test should be risk = low. As written, the logic is reversed and high-risk logins get the easy path.

B — The extra check should be skipped for trusted (known) devices. It should read IF device IN trusted. With NOT IN, known devices are challenged and unknown devices skip the check.