Identify and Access Management Fundamentals
Core concepts
Identity and Access Management (IAM) is the discipline of ensuring the right subjects get the right access to the right resources for the right reasons. Start with the identity lifecycle: provisioning (creating an identity and its entitlements), maintenance (moves, role changes), and de-provisioning (timely removal). Understand the AAA triad: authentication (proving who you are), authorization (what you may do), and accounting/auditing (what you did).
Know the four classic access-control models. DAC (discretionary) lets owners grant access; MAC (mandatory) enforces labels/clearances set by policy; RBAC (role-based) grants access via job roles; ABAC (attribute-based) evaluates attributes of subject, resource, action, and context. Also know least privilege, separation of duties, and need-to-know.
Traps
Questions love to blur authentication with authorization, or attribute-based decisions with role-based ones. If a rule references department and time-of-day and resource classification, that is ABAC, not RBAC. Another trap: confusing identification (claiming an identity, e.g., a username) with authentication. Watch for "implicit deny" phrasing-default-deny means anything not explicitly allowed is refused.
Rule of thumb
Ask: who is deciding access? Owner discretion → DAC; central labels → MAC; job function → RBAC; multi-attribute policy → ABAC. If the scenario rewards fine-grained, context-aware decisions, choose ABAC; if it rewards administrative simplicity at scale, choose RBAC.