IM-CCM study plan

IM-CCM · Give each week a clear focus.

8 weeks · About 7 hours per week

Week 1

Identity Governance and Administration

Define the core IGA vocabulary (identity lifecycle, joiner-mover-leaver, entitlement, role mining, attestation) in your own words
Diagram a joiner-mover-leaver workflow from HR event to downstream provisioning
Distinguish role-based, rule-based, and attribute-based access assignment with one example each
Explain how segregation-of-duties conflicts are detected and remediated

A one-page IGA lifecycle diagram with 10 vocabulary terms defined and 3 SoD conflict examples

Week 2

Compare access certification vs. role recertification campaign designs
Describe how to build an audit-ready evidence trail for a certification decision
Map IGA controls to common compliance frameworks at a conceptual level
Identify three failure modes of stale access reviews and how to detect them

A mock access-review campaign plan covering scope, reviewers, cadence, and evidence retention

Week 3

Compare authentication factors by strength (knowledge, possession, inherence) and give two examples of each
Explain how MFA enrollment and recovery flows can be attacked and how to harden them
Describe session management risks: fixation, token replay, and timeout policy
Differentiate step-up authentication from adaptive/risk-based authentication

A threat-model table of 6 authentication attack scenarios with a mitigating control for each

Week 4

Explain OAuth 2.0 roles and flows at a conceptual level (authorization code with PKCE, client credentials)
Distinguish authentication from authorization in a delegated-access scenario
Describe how directories and identity stores are structured (users, groups, OUs)
Compare centralized vs. decentralized access control models

A written comparison of 3 access-control models with a worked example of each applied to a sample org

Week 5

Classify privileged accounts by type (shared, service, emergency/break-glass, admin)
Design a just-in-time elevation workflow including approval and time-bound expiry
Explain credential vaulting, rotation, and session recording controls
Describe how to detect and respond to misuse of a break-glass account
Differentiate PAM controls for on-premises vs. cloud admin planes

A PAM control matrix mapping 5 privileged account types to vaulting, rotation, and monitoring controls

Week 6

Explain how SAML and OIDC assertions establish federated trust between an IdP and an SP
Describe how trust relationships, metadata, and certificate rotation are managed
Compare identity federation across multiple clouds vs. a single identity provider
Identify risks in token issuance, audience restriction, and assertion validation

A federated SSO architecture sketch with 5 named trust boundaries and the control at each boundary

Week 7

Map cloud IAM risks (over-permissive roles, wildcard policies, orphaned identities) to mitigations
Describe how to audit cloud role assignments and detect privilege creep
Explain how identity risk metrics feed into compliance reporting
Outline how an identity-related incident is investigated end-to-end

A cloud IAM risk register with 8 risks, likelihood/impact ratings, and a mitigation owner for each

Week 8

Synthesize all six domains into a single end-to-end identity architecture narrative
Rehearse 20 timed practice questions and categorize each error by domain
Revisit your two weakest domains and close the specific gaps identified
Build a one-page quick-reference sheet of key distinctions and definitions

A full-length timed practice exam attempt with an error log and a one-page quick-reference sheet

Week 2: Complete the mock access-review plan and score at least 70% on a 20-question IGA self-quiz

Week 4: Explain OAuth flows and access-control models aloud without notes for 5 minutes

Week 6: Deliver the federated SSO sketch and correctly identify all 5 trust boundaries

Week 8: Score at least 80% on the full-length timed practice exam with every error logged by domain