Identity Governance and Administration
Core concepts
Identity Governance and Administration (IGA) covers the controls that keep identities accurate, entitlements appropriate, and access provable. The backbone is the identity lifecycle driven by an authoritative HR or system of record. Key processes: joiner-mover-leaver automation, access requests and approvals, role management and role mining, access certification/recertification (periodic reviews by managers or resource owners), and segregation-of-duties (SoD) analysis to detect toxic combinations.
Distinguish RBAC role engineering: top-down (design roles from business functions) versus bottom-up (mine roles from existing entitlements). Understand entitlement catalogs, birthright access (default access on hire), and orphan accounts (accounts with no valid owner). Governance also produces evidence: certification campaigns, remediation tickets, and policy attestations.
Traps
Examiners often swap access certification (reviewers attest existing access) with access request (users ask for new access). Another common trap: treating role mining as a security control rather than a design technique. Also watch for leaver scenarios-questions test whether you disable accounts promptly and revoke entitlements, not merely delete the mailbox. Orphan and dormant accounts are frequent red flags in audit-style items.
Rule of thumb
Governance = prove it and fix it. If a scenario asks how to demonstrate that access is still appropriate, the answer is a periodic access certification with documented reviewer sign-off and remediation of exceptions. If it asks how to prevent toxic combinations at request time, the answer is preventive SoD policy enforcement, not after-the-fact review.