Identity Governance
Identity Governance is the domain that tests whether you can connect identity lifecycle events to policy, least privilege, segregation of duties (SoD), and auditable evidence. The exam focuses on governance decisions and controls, not merely account creation. A strong answer starts with the authoritative source of identity data, usually HR for employees and a contract or sponsor record for non-employees, then maps each lifecycle event to entitlement changes and review obligations.
Core rules and concepts
- Governance owns the entitlement catalog: every access right has an owner, risk rating, and business justification.
- Joiner-mover-leaver (JML) events must trigger provisioning, de-provisioning, and re-certification. A mover is high risk because old access often survives.
- Role-based access control (RBAC) simplifies assignment, but roles need periodic mining and cleanup; attribute-based rules can handle exceptions.
- Segregation of duties prevents one identity from completing a sensitive end-to-end transaction, such as creating a vendor and approving its payment.
- Access certifications are evidence: reviewers attest specific entitlements, not 'all access,' and exceptions have expiry dates.
- Orphan and dormant accounts are governance defects; privileged accounts need more frequent review and break-glass evidence.
Worked example
An accounts-payable clerk moves to accounts-receivable. HR records the transfer on 1 June. The governance team should remove the vendor-master and payment-approval entitlements, add receivables and collections roles, and open a manager certification for retained access. The reasoning is that the transfer creates both excessive access and a possible SoD conflict: the user could create a vendor and approve a payment if old rights remain. Evidence should include the HR event, the removed and added entitlements, reviewer approval, and closure date.
Traps that cost marks
Treating governance as only provisioning; certifying 'all access' instead of named entitlements; leaving mover access until the next quarterly review; accepting HR as the only source for contractors; and recording exceptions without an owner or expiry. Each exception needs a compensating control and a closure date.