Identity and Access Management
Domain 3: Identity and Access Management
This domain tests how identities are created, authenticated, authorized, reviewed, and removed. Expect questions on joiner-mover-leaver processes, federation and single sign-on, MFA, privileged access management, role design, and access certification.
Core rules and concepts
- Authentication proves identity; authorization decides access. A successful login does not imply permission to a resource.
- Lifecycle: provisioning starts from an approved request and authoritative source; a mover requires removal of old access before adding new; a leaver requires timely disablement, session revocation, and token revocation.
- Least privilege and separation of duties: grant the minimum role for the task and prevent toxic combinations such as create-vendor plus approve-payment.
- RBAC assigns permissions to roles and roles to users; ABAC uses attributes such as department, device posture, and time. ABAC can reduce role explosion but needs clean attributes.
- Federation uses trust between identity providers and service providers, commonly with SAML or OIDC. SSO improves user experience but concentrates risk; protect the identity provider with strong MFA and monitoring.
- PAM: vault privileged credentials, broker sessions, rotate secrets, and record administrative activity. Avoid shared accounts; where they exist, make them accountable and monitored.
Worked example
A contractor needs read-only access to a finance reporting application for 90 days. You federate the contractor's home identity, require phishing-resistant MFA, assign a read-only role scoped to the reporting module, set an expiry date, and schedule an access review before day 60. You disable local accounts and log all access. Reasoning: federation avoids a new password store, the role enforces least privilege, expiry limits lingering access, and review catches drift. Giving the contractor a finance team role would violate least privilege; sharing a team account would destroy accountability.
Traps that cost marks
Do not confuse SSO with authorization. Do not use MFA as a substitute for least privilege. Do not leave orphaned accounts after a mover event. Do not create one role per user unless justified. Do not vault a privileged password but allow unlimited direct use outside the vault.