Access Management and Authentication
Core concepts
This domain covers how users authenticate and how sessions and credentials are managed. Know the authentication factors: something you know (password), have (token, certificate), are (biometrics), and-contextually-where you are or what you do. MFA combines factors from different categories; two passwords are not MFA.
Understand SSO and session management: tokens, cookies, session timeouts, and re-authentication for sensitive actions. Know password policy basics (length, complexity, reuse, lockout, rotation guidance) and why credential stuffing and brute force defenses rely on rate limiting, lockout, and MFA. Study federation-adjacent protocols at a conceptual level: SAML assertions, OAuth 2.0 authorization, and OIDC identity tokens. Understand step-up authentication and adaptive/risk-based authentication that triggers extra checks on anomalous context.
Traps
A classic trap: calling a username-plus-password-plus-security-question flow "MFA"-both are knowledge factors. Another: confusing OAuth (authorization/delegated access) with authentication; OIDC adds the identity layer. Watch for SSO questions where the real risk is a compromised central session-answers should include session timeout, device posture, and re-authentication, not just stronger passwords.
Rule of thumb
Count categories, not prompts. If every challenge tests memory, it is single-factor no matter how many screens appear. For risk-based scenarios, layer adaptive authentication: low-risk context → password plus device check; high-risk (new device, impossible travel) → step-up MFA.