Identity and Access Management
What to know
IAM spans identification, authentication, authorization, and accounting. Know the factor categories - something you know, have, are, do, and somewhere you are - and that multifactor authentication requires factors from different categories. Understand authentication assurance levels and why step-up authentication is used for sensitive transactions.
Master the access-control models: discretionary, mandatory (labels and clearances), role-based, attribute-based, and rule-based. Understand least privilege, separation of duties, and need-to-know. Know the identity lifecycle: joiner, mover, leaver - with access removal and credential revocation at the leaver stage being the highest-priority control. Privileged access management covers vaulting, session recording, just-in-time elevation, and break-glass accounts.
Federation concepts matter: assertions, identity providers, service providers, trust relationships, and single sign-on tradeoffs (convenience versus a single point of compromise). Know token types conceptually and why short-lived tokens with refresh reduce exposure. Directory hygiene - stale accounts, orphaned accounts, and entitlement creep - is a recurring audit finding.
Traps
Questions conflate authentication (proving identity) with authorization (granting permissions). Another common trap: SSO does not eliminate the need for per-application authorization. Beware options that say MFA "prevents" credential theft - it reduces risk but does not stop session hijacking or phishing of one-time codes. Also, role-based access control does not automatically enforce least privilege unless roles are reviewed and pruned.
Worked example
A departing employee's account is disabled at the end of their last day, but their API token remains valid for 90 days. The correct remediation is to revoke all credentials and tokens at termination and maintain a token inventory with maximum lifetimes - disabling the directory account alone is insufficient.
Rule of thumb: identity is the new perimeter - verify continuously, authorize minimally, and revoke immediately.