Essential Eight: application control and multi-factor authentication

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which statement best describes application control in the Essential Eight?

A Any software can run as long as antivirus scans it afterwards

B Only software on an approved list is allowed to run

2. A developer downloads a free tool that is not on the organisation's approved software list. With application control in place, what happens?

A The tool is blocked from running

B The tool runs, but the developer gets a warning

3. Which is the better description of how an approved software list works?

A Allowlist: only listed programs run, everything else is blocked

B Blocklist: only known bad programs are stopped, everything else runs

4. Which Essential Eight control requires extra proof of identity beyond a password?

A Multi-factor authentication (MFA)

B Application control

5. Where should MFA be enforced first to follow Essential Eight guidance?

A Only on public pages that have no login

B Privileged accounts and remote access, such as VPN logins

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1allowlist = ["VSCode", "Chrome", "Git"]		AApplication control should only run approved software from an allowlist. This code runs anything not on a blocklist of known bad programs, so new malware gets through.
2if password_ok and code_ok: login()		Bif app not in allowlist: block(app)
3Application control blocks any program that is not on the approved list, which stops malware from running		CThe 'or' means one factor is enough, so a stolen password alone gets in. MFA needs both factors, so it should use 'and'.
4MFA for privileged and remote access requires an extra proof before an admin or remote user gets in		Dif remote and not mfa_passed: deny()
5if app in blocklist: run(app)		EAn approved software list: only the applications named in it are allowed to run
6if password_ok or code_ok: login()		FMulti-factor authentication: access is granted only when a second proof of identity is also correct

Definitions

Application control and MFA

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF app __ approvedList THEN run(app) ENDIF

approved = ["Word", "Chrome", "VSCode"] if app ___ in approved: block(app)

passwordOk = checkPassword(user) codeOk = checkCode(user) IF passwordOk ___ codeOk THEN

IF role = "admin" __ remote = TRUE THEN requireMFA(user) ENDIF

IF mfaPassed THEN allow(user) ____ deny(user) ENDIF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A approved = ["chrome", "word"]

B if app not in approved:

C run(app)

D else:

E block(app)

Question 2

A allowlist = ["Word", "Teams"]

B app = get_requested_app()

C if app in blocklist:

D run(app)

Question 3

A user = get_username()

B pw_ok = check_password(user)

C code_ok = check_code(user)

D if pw_ok or code_ok:

E grant_access(user)

Question 4

A role = get_role(user)

B if role == "admin":

C require_password(user)

D grant_access(user)

Question 5

A approved = ["Word", "*"]

B new_app = "free_game.exe"

C if new_app not in approved:

D block(new_app)

Answer Key

Essential Eight: application control and multi-factor authentication

Section A: Quick Questions

B — Only software on an approved list is allowed to run

A — The tool is blocked from running

A — Allowlist: only listed programs run, everything else is blocked

A — Multi-factor authentication (MFA)

B — Privileged accounts and remote access, such as VPN logins

Section B: Match the Pairs

allowlist = ["VSCode", "Chrome", "Git"] → An approved software list: only the applications named in it are allowed to run

if password_ok and code_ok: login() → Multi-factor authentication: access is granted only when a second proof of identity is also correct

Application control blocks any program that is not on the approved list, which stops malware from running → if app not in allowlist: block(app)

MFA for privileged and remote access requires an extra proof before an admin or remote user gets in → if remote and not mfa_passed: deny()

if app in blocklist: run(app) → Application control should only run approved software from an allowlist. This code runs anything not on a blocklist of known bad programs, so new malware gets through.

if password_ok or code_ok: login() → The 'or' means one factor is enough, so a stolen password alone gets in. MFA needs both factors, so it should use 'and'.

Section C: Definitions

Application control and MFA — Essential Eight controls: application control lets only approved software run, and MFA needs extra proof of identity, so both block unauthorised access and malware.

Section D: Fill in the Blanks

IF app IN approvedList THEN
    run(app)
ENDIF

approved = ["Word", "Chrome", "VSCode"]
if app not in approved:
    block(app)

passwordOk = checkPassword(user)
codeOk = checkCode(user)
IF passwordOk AND codeOk THEN

IF role = "admin" OR remote = TRUE THEN
    requireMFA(user)
ENDIF

IF mfaPassed THEN allow(user)
ELSE deny(user)
ENDIF

Section E: Spot the Error

B — Application control only lets approved software run. 'not in' reverses the check, so unapproved programs run and approved ones are blocked. It should be: if app in approved:

C — Application control uses an approved list (allowlist), not a list of known bad programs. New malware would not be on a blocklist and would run. It should be: if app in allowlist:

D — MFA needs both factors to pass. With 'or', a stolen password alone would get an attacker in. It should be: if pw_ok and code_ok:

C — Privileged accounts need extra proof of identity. A password is the same single factor, so it is not MFA. It should be: require_mfa(user)

A — The wildcard "*" approves every program, so the approved list no longer restricts anything and malware could run. The list should name only specific approved software, e.g. ["Word", "Teams"].