Essential Eight: restricting administrative privileges

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which statement best describes the Essential Eight strategy 'restrict administrative privileges'?

A Every developer gets an admin account so they can work without delays

B Only people who need admin accounts get them, and only for tasks that need them

2. A developer needs to read emails and browse the web as well as manage servers. What is the better setup?

A One admin account used for everything to keep things simple

B A standard account for daily tasks and a separate admin account for admin tasks

3. Who should be able to make changes directly to the production environment?

A Only a small number of approved staff who need that access

B All developers, because they wrote the code

4. Which is a good example of restricting administrative privileges?

A Removing admin rights from a developer who has moved to a different project

B Letting a developer keep admin rights just in case they need them later

5. How does restricting administrative privileges link to the principle of least privilege?

A It applies least privilege to powerful accounts by giving only the access needed

B It is unrelated, because least privilege only applies to standard users

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1restrict administrative privileges		AAn Essential Eight strategy that limits powerful admin accounts to people who need them, and only for the tasks that need them
2adminAccount = "j.lee-admin"		BEvery developer has admin access to production, even those who do not need it, which widens the attack surface
3Only a small named group of developers can change the production environment		Cif user.role != "admin": deny(adminPanel)
4Restricting admin privileges applies the principle of least privilege by giving only the access needed for a role		DEveryday accounts used for email and browsing are given permanent admin rights, so malware or phishing could run with full control
5developer.email = "sam@corp.com" developer.privileges = "domain admin"		Eproduction.allowedUsers = ["leadDev", "opsAdmin"]
6grantAccess(everyDeveloper, production, "admin")		FA separate admin account used only for admin tasks, kept apart from the person's everyday user account

Definitions

restrict administrative privileges

Fill in the Blanks

Complete each line of code by filling in the missing parts.

GRANT ______ ON prod.* TO auditor;

REVOKE ___ ON prod.* FROM devUser;

IF needsTask ___ isAdmin THEN

CREATE ____ aliceAdmin;

REVOKE DROP ON prod.* ____ devUser;

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A def can_use_admin(user, task):

B if user.role != 'admin':

C return False

D return True

Question 2

A def pick_account(task):

B if task == 'install_software':

C return 'sam_admin'

D return 'sam_admin'

Question 3

A prod_admins = ['ops_lead']

B if user.is_staff:

C allow(user)

D else:

E deny(user)

Question 4

A admin_accounts = everyone

B for acct in admin_accounts:

C grant_admin(acct)

D log(acct, 'granted')

Question 5

A def finish_task(user):

B log(user, 'task done')

C user.admin = True

D return user

Answer Key

Essential Eight: restricting administrative privileges

Section A: Quick Questions

B — Only people who need admin accounts get them, and only for tasks that need them

B — A standard account for daily tasks and a separate admin account for admin tasks

A — Only a small number of approved staff who need that access

A — Removing admin rights from a developer who has moved to a different project

A — It applies least privilege to powerful accounts by giving only the access needed

Section B: Match the Pairs

restrict administrative privileges → An Essential Eight strategy that limits powerful admin accounts to people who need them, and only for the tasks that need them

adminAccount = "j.lee-admin" → A separate admin account used only for admin tasks, kept apart from the person's everyday user account

Only a small named group of developers can change the production environment → production.allowedUsers = ["leadDev", "opsAdmin"]

Restricting admin privileges applies the principle of least privilege by giving only the access needed for a role → if user.role != "admin": deny(adminPanel)

developer.email = "sam@corp.com" developer.privileges = "domain admin" → Everyday accounts used for email and browsing are given permanent admin rights, so malware or phishing could run with full control

grantAccess(everyDeveloper, production, "admin") → Every developer has admin access to production, even those who do not need it, which widens the attack surface

Section C: Definitions

restrict administrative privileges — An Essential Eight strategy: give admin accounts only to people who need them, only for tasks that need them, using separate admin accounts and limited production access.

Section D: Fill in the Blanks

GRANT SELECT ON prod.* TO auditor;

REVOKE ALL ON prod.* FROM devUser;

IF needsTask AND isAdmin THEN

CREATE USER aliceAdmin;

REVOKE DROP ON prod.* FROM devUser;

Section E: Spot the Error

D — Admin rights should be limited to the tasks that need them. Returning True lets an admin do any task. It should be 'return task in user.tasks'.

D — A separate admin account should only be used for admin tasks. Everyday work should use the standard account 'sam'.

B — Access to production must be limited to a small approved list. Checking is_staff lets all staff in. It should be 'if user in prod_admins:'.

A — Admin accounts should go only to people who need them. Giving them to everyone breaks the strategy. The list should name the specific admin accounts.

C — Admin rights should only last for the task that needs them. Setting admin to True keeps the privilege after the task. It should be False.