Access Management
Access Management tests how identities prove who they are and how systems decide what they may do. The exam distinguishes authentication, authorization, federation, session control, and privileged access, and expects controls that enforce least privilege across cloud and on-premises applications.
Core rules and concepts
- Identification is the claimed identity; authentication verifies it; authorization decides access. A single sign-on (SSO) event authenticates, but it does not by itself grant every application right.
- Authentication factors are knowledge, possession, and inherence. MFA requires factors from different categories; two passwords are not MFA.
- Federation uses trust: SAML assertions or OIDC ID tokens carry identity claims between an identity provider (IdP) and a service provider (SP). The SP must validate signature, issuer, audience, expiry, and nonce or state where applicable.
- OAuth 2.0 is for delegated authorization, not authentication by itself; OIDC adds an identity layer. Public clients should use authorization code flow with PKCE.
- Least privilege uses roles, groups, scopes, and just-in-time elevation. Privileged access management (PAM) adds vaulting, session recording, and approval for administrative accounts.
- Session controls include timeout, re-authentication for sensitive actions, token revocation, and device or network context. A lost device should trigger session revocation, not only a password change.
Worked example
A workforce SaaS app is configured for OIDC SSO. The app receives an ID token and maps an IdP group 'finance-readers' to a read-only finance role. A user in that group tries to approve an invoice. The correct reasoning is that SSO proves identity, but authorization comes from the app's role mapping and policy; the read-only role must not include approval. The app should validate the token, check the group claim, and deny the action, while logging the authorization decision.
Traps that cost marks
Equating SSO with authorization; calling password-plus-security-question MFA; accepting tokens without audience or signature checks; using implicit flow for public clients; and sharing administrative accounts instead of using PAM.