I85PREP
⌘ K
DAPLE (C1) study materials
DAPLE (C1) study resources

DAPLE (C1): Access Control, Identity, and Authentication

DAPLE (C1) · Work through your exam, one topic at a time.

All guide sections

Access Control, Identity, and Authentication

What this domain tests

Questions here probe whether you can separate authentication from authorisation, choose an access model that fits a scenario, and control privileged and non-human identities. Expect distractor answers that solve the wrong problem.

Core rules

  • AAA. Identification, authentication (who you are), authorisation (what you may do), accountability (what you did, via logging).
  • Models. RBAC is role-based and prone to role explosion. ABAC evaluates attributes through a policy engine and scales better for context. ReBAC models relationships. MAC and DAC are mostly historical. Real deployments are hybrid.
  • Least privilege, need-to-know, separation of duties. Privileged access management covers vaulting, session recording, just-in-time elevation and break-glass accounts with alerting.
  • Authentication factors. Knowledge, possession, inherence. Phishing-resistant options are FIDO2/WebAuthn and passkeys; push notifications need number matching; SMS OTP is weak against interception and SIM swap.
  • Federation. SSO via SAML 2.0 or OIDC. OAuth 2.0 is an authorisation framework, not an authentication protocol; OIDC layers identity on top. SCIM automates provisioning and deprovisioning.
  • Lifecycle. Joiner/mover/leaver processes, periodic access reviews with evidence of decisions, orphan and dormant account sweeps, secrets management, and coverage of service accounts and API keys.

Worked example

A contractor needs read-only access to one customer database for three weeks. Design: federated SSO with phishing-resistant MFA, a scoped read-only role bound to a specific schema, just-in-time elevation approved by the data owner with a fixed end date, full session logging, and automatic deprovisioning through SCIM. Access is reviewed at closure. Reasoning: each element addresses a distinct risk - identity assurance, scope, duration, oversight, removal.

Traps that cost marks

Calling OAuth an authentication protocol; tolerating role explosion instead of moving to attribute-based policy; allowing shared or generic accounts; approving access reviews without evidence of decisions; forgetting non-human identities such as service accounts and keys.