Security, Users, Groups, and Permissions
Security in AEM rests on the Oak permission model. A candidate must understand users, groups, and the principal-based permission evaluation: allow and deny ACEs, the order of evaluation, and why deny takes precedence in practice. Know the difference between privileges (jcr:read, jcr:write, jcr:nodeTypeManagement, replication) and permissions, and how to inspect effective permissions with the user/group administration console or the CRXDE access control editor. Understand the built-in groups (administrators, content-authors, dam-users, contributors) and why custom groups are preferred over direct user assignment.
Key concepts include service users for background processes, the principle of least privilege, and the separation of author and publish permissions. Know how authentication works: SAML and OAuth for SSO, the trusted authentication handler, and the difference between authentication and authorization. Understand CSRF protection, the dispatcher filter as a security boundary, and the secure handling of secrets via Cloud Manager environment variables.
Traps include granting permissions to everyone (- everyone group) or to the anonymous user, or assuming a deny ACE always wins without understanding evaluation order. Another trap is giving a service user administrator rights for convenience. Expect questions on why an author can see a page but not edit it (read versus write on the node and its children), and on why a publish-side API returns 403 (service user mapping or dispatcher filter).
Rule of thumb: grant the minimum privilege at the highest sensible node, use groups, and never widen anonymous access. Worked example: a background workflow needs to read assets. Create a service user mapped to a custom group with jcr:read on the asset paths only, not administrators.