Identity and Access Management
Core concepts
Know the AAA triad: authentication, authorization, accounting. Distinguish the factors: something you know, have, are (plus location and behavior). Understand MFA requires different factor types, not two of the same type. Know access control models: DAC (owner discretion), MAC (labels/clearance), RBAC (role-based), ABAC (attribute-based, most granular). Understand least privilege and separation of duties.
Identity lifecycle
Memorize the lifecycle: registration/proofing, provisioning, maintenance, deprovisioning. Know that timely deprovisioning on termination is a top audit finding. Understand federation (SAML, OIDC), SSO, and that SSO concentrates risk on the identity provider. Know password storage best practice (salted hashes, never reversible encryption) and that biometric systems trade false accept vs false reject rates.
Traps
A frequent trap is calling two passwords "MFA" - it is not. Another is confusing authentication (who you are) with authorization (what you can do). Watch for RBAC vs ABAC questions: ABAC handles context (time, location) that RBAC cannot. Also, a question may test whether SSO increases or decreases risk - it reduces password sprawl but concentrates blast radius.
Rule of thumb
When a question describes access based on job function, choose RBAC; when it depends on context/attributes, choose ABAC. When it asks about a departing employee, the first action is disable/deprovision the account, not delete it.