User Account and Security Management
User accounts are managed with AUTHORIZE (in SYS$SYSTEM:). Each UAF record carries a username, UIC (group,member), password, account privileges, quotas, and flags. The candidate must understand UIC format [group,member] and that group 1 is typically system. Privileges divide into none, normal, and those requiring CMKRNL/SECURITY; know the big ones: OPER, BYPASS, SYSPRV, GRPPRV, CMKRNL, CMEXEC, SYSNAM, SYSPRV, and SECURITY. A frequent trap is assuming BYPASS grants all access - it bypasses protection but not all privilege checks.
Password policy: SYSTEM password, password lifetime, minimum length, and the generation of password history are set with AUTHORIZE qualifiers or SYSMAN SET PASSWORD. Know that the SECURITY profile (via AUTHORIZE /DEFAULT or the SECURITY profile) governs systemwide defaults like LGI attempts and password lifetime. Understand break-in detection and evasion, and that intrusion records are examined with the SECURITY_AUDIT or break-in database tools.
Traps: confusing UIC-based protection with ACL-based protection; forgetting that rights identifiers (from RIGHTSLIST) can be granted to holders and used in ACLs; and mixing up the meaning of the W (write), L (lock), and control access bits. Also remember that the SYSTEM account is special and that CAPTIVE and RESTRICTED flags change login behavior.
Rule of thumb: when a question asks how to grant a user access to a protected object without changing the file's UIC protection, the answer is an ACL granting a rights identifier - not a privilege.