Identity and Access Management
Core ideas
IAM answers who can access what, and how that is proven and enforced. Authentication verifies identity (something you know, have, or are); authorization decides permissions; accounting logs activity. Multi-factor authentication combines factors from different categories and is far stronger than single-factor.
Models and principles
Know the access control models: discretionary (owner decides), mandatory (labels/clearances), role-based (job function), and attribute-based (context-aware). Least privilege and separation of duties limit risk. Privileged access management controls admin accounts, and just-in-time access grants rights temporarily.
Identity lifecycle and federation
Understand provisioning and deprovisioning, and why timely deprovisioning matters (orphaned accounts are a major risk). Federation and single sign-on (SSO) let one identity work across systems; SAML and OIDC are common standards. Directory services like LDAP store identity data.
Traps in questions
A frequent trap is treating two passwords as MFA; they are the same factor (knowledge). Another is confusing authentication with authorization: logging in is authentication, accessing a resource is authorization. Watch for scenarios where the correct answer is deprovisioning rather than simply disabling, and remember that SSO concentrates risk, so the identity provider must be strongly protected.
Worked example
An employee moves departments. The trap answer is to grant new permissions only. The correct approach is to review and remove old role permissions while granting new ones, enforcing least privilege and avoiding privilege creep.
Rule of thumb
MFA must use different factor categories. When access changes, always remove what is no longer needed before adding new rights.