← VCE Software Development U4O2

Essential Eight: application control and multi-factor authentication

Essential Eight controls: application control lets only approved software run, and MFA needs extra proof of identity, so both block unauthorised access and malware.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 94

Understanding Essential Eight: application control and multi-factor authentication in VCE Software Development U4O2

What it does: The check compares each program with the approved software list and blocks anything unapproved, such as malware. Remote and privileged accounts are high risk, so access is denied unless the extra MFA proof has been passed. MFA asks for two or more factors, such as a password plus a code or an authenticator app. Application control controls which software runs, not who logs in. MFA needs more than one proof of identity, so a stolen password alone cannot unlock an account. MFA only protects an account if every required proof is checked, so the condition must use 'and'.

Common mistakes: Application control only lets approved software run. 'not in' reverses the check, so unapproved programs run and approved ones are blocked. It should be: if app in approved:. Application control uses an approved list (allowlist), not a list of known bad programs. New malware would not be on a blocklist and would run. It should be: if app in allowlist:.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Essential Eight: application control and multi-factor authentication to a class →

This module's key terms are also in a printable crossword (Modules 81–95) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which statement best describes application control in the Essential Eight?
Only software on an approved list is allowed to runAny software can run as long as antivirus scans it afterwards
Matches
if app in blocklist: run(app)
↓
Application control should only run approved software from an allowlist. This code runs anything not on a blocklist of known bad programs, so new malware gets through.
Applying
Meanings
Term
Application control and MFA
Meaning
Essential Eight controls: application control lets only approved software run, and MFA needs extra proof of identity, so both block unauthorised access and malware.
Practice
approvedSoftware ← ["Chrome", "VSCode"]
Testing
Gaps
IF app approvedList THEN
Check Answer
Spots
1approved = ["chrome", "word"]
2if app not in approved:

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Manta Ray' badge — Graceful Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which statement best describes application control in the Essential Eight?
A. Any software can run as long as antivirus scans it afterwards
B. Only software on an approved list is allowed to run ✓
Application control uses an approved software list (allowlist). Anything not on the list, including malware, is blocked from running.
2. A developer downloads a free tool that is not on the organisation's approved software list. With application control in place, what happens?
A. The tool is blocked from running ✓
B. The tool runs, but the developer gets a warning
Application control blocks unapproved software by default. This stops unknown programs and malware from running, even if a user installs them.
3. Which is the better description of how an approved software list works?
A. Allowlist: only listed programs run, everything else is blocked ✓
B. Blocklist: only known bad programs are stopped, everything else runs
Application control is based on an allowlist of approved software. A blocklist would miss new malware that is not yet known.
4. Which Essential Eight control requires extra proof of identity beyond a password?
A. Multi-factor authentication (MFA) ✓
B. Application control
MFA asks for two or more factors, such as a password plus a code or an authenticator app. Application control controls which software runs, not who logs in.
5. Where should MFA be enforced first to follow Essential Eight guidance?
A. Only on public pages that have no login
B. Privileged accounts and remote access, such as VPN logins ✓
Privileged and remote access are high-risk because attackers can gain wide control from outside the network. MFA adds a barrier if the password is stolen.

Match the Pairs

allowlist = ["VSCode", "Chrome", "Git"] → An approved software list: only the applications named in it are allowed to run
if password_ok and code_ok: login() → Multi-factor authentication: access is granted only when a second proof of identity is also correct
Application control blocks any program that is not on the approved list, which stops malware from running → if app not in allowlist: block(app)
MFA for privileged and remote access requires an extra proof before an admin or remote user gets in → if remote and not mfa_passed: deny()
if app in blocklist: run(app) → Application control should only run approved software from an allowlist. This code runs anything not on a blocklist of known bad programs, so new malware gets through.
if password_ok or code_ok: login() → The 'or' means one factor is enough, so a stolen password alone gets in. MFA needs both factors, so it should use 'and'.

Key Term

Application control and MFA
Essential Eight controls: application control lets only approved software run, and MFA needs extra proof of identity, so both block unauthorised access and malware.

Fill in the Blanks

1. IF app IN approvedList THEN run(app) ENDIF
Hint: Type the keyword that checks whether an item is found in a list.
2. approved = ["Word", "Chrome", "VSCode"] if app not in approved: block(app)
Hint: Type the operator that reverses the list check, so software missing from the approved list gets blocked.
3. passwordOk = checkPassword(user) codeOk = checkCode(user) IF passwordOk AND codeOk THEN
Hint: Type the logical operator that requires both factors to be true before access is granted.
4. IF role = "admin" OR remote = TRUE THEN requireMFA(user) ENDIF
Hint: Type the logical operator that needs only one of the two conditions to be true to trigger the MFA check.
5. IF mfaPassed THEN allow(user) ELSE deny(user) ENDIF
Hint: Type the keyword that starts the branch used when the extra proof of identity fails.

Spot the Error

Question 1
A approved = ["chrome", "word"]
B if app not in approved:
C run(app)
D else:
E block(app)
Line B — Application control only lets approved software run. 'not in' reverses the check, so unapproved programs run and approved ones are blocked. It should be: if app in approved:
Question 2
A allowlist = ["Word", "Teams"]
B app = get_requested_app()
C if app in blocklist:
D run(app)
Line C — Application control uses an approved list (allowlist), not a list of known bad programs. New malware would not be on a blocklist and would run. It should be: if app in allowlist:
Question 3
A user = get_username()
B pw_ok = check_password(user)
C code_ok = check_code(user)
D if pw_ok or code_ok:
E grant_access(user)
Line D — MFA needs both factors to pass. With 'or', a stolen password alone would get an attacker in. It should be: if pw_ok and code_ok:
Question 4
A role = get_role(user)
B if role == "admin":
C require_password(user)
D grant_access(user)
Line C — Privileged accounts need extra proof of identity. A password is the same single factor, so it is not MFA. It should be: require_mfa(user)
Question 5
A approved = ["Word", "*"]
B new_app = "free_game.exe"
C if new_app not in approved:
D block(new_app)
Line A — The wildcard "*" approves every program, so the approved list no longer restricts anything and malware could run. The list should name only specific approved software, e.g. ["Word", "Teams"].

Student with a class code? Join your class →