Identity, Access, and Data Protection
What to know
Identity is the modern control plane. Understand the identity lifecycle: proofing, provisioning, authentication, authorization, review, and deprovisioning, plus joiner-mover-leaver risk. Know authentication factors and MFA, phishing-resistant authenticators (FIDO2/passkeys), and why SMS OTP is weaker. Understand federation concepts: SAML versus OIDC, identity providers, SSO, and the trust relationships they create. Know authorization models: RBAC, ABAC, and policy-based access, and where least privilege and separation of duties apply.
Privileged access management is heavily tested: just-in-time access, vaulting, session recording, break-glass accounts, and service account hygiene. Know Zero Trust identity principles and conditional access based on device and context. For data protection, understand classification, labeling, DLP, data lifecycle (create, store, use, share, archive, destroy), and privacy concepts such as data minimization and purpose limitation. Know masking, tokenization, and encryption as distinct techniques with different reversibility and use cases.
Traps
- Confusing authentication (who you are) with authorization (what you may do).
- Treating MFA as uniform; factor strength and phishing resistance differ.
- Forgetting deprovisioning of tokens, keys, and service accounts at offboarding.
- Assuming tokenization and encryption are interchangeable; tokenization removes sensitive data from scope.
Worked example / rule of thumb
A contractor needs admin rights for two weeks. Correct: time-bound role, JIT elevation with approval, vaulted credentials, session logging, and automatic revocation. Rule of thumb: privilege should be temporary by default and permanent only by exception.