I85PREP
⌘ K
ATSA study materials
ATSA study resources

ATSA: Identity and Access Management

ATSA · Work through your exam, one topic at a time.

All guide sections

Identity and Access Management

Identity and Access Management

This domain tests authentication factors, federation protocols, authorization models, and the identity lifecycle. Many items turn on a precise protocol distinction - especially OAuth versus OIDC and RADIUS versus TACACS+.

Authentication

Factors are something you know, something you have, and something you are, with location and behavior used as contextual signals. MFA requires different factor types: password plus PIN is the same factor twice. FIDO2/WebAuthn is phishing-resistant because credentials are origin-bound public-key pairs; TOTP beats SMS, which is exposed to SIM swapping.

Federation and protocols

  • Kerberos: ticket-based domain SSO (TGT then service tickets); time-sensitive, so clock skew breaks it.
  • SAML 2.0: XML assertions for browser-based enterprise SSO.
  • OAuth 2.0: delegated authorization that issues scoped access tokens - it does not authenticate the user.
  • OIDC: an identity layer on OAuth; the ID token (a JWT) asserts who the user is.
  • RADIUS: network access AAA for 802.1X and VPN. TACACS+: device administration, separates the AAA functions and encrypts the entire payload.
  • LDAP: directory queries and bind authentication.

Authorization models

MAC uses labels and clearances; DAC lets the owner set permissions; RBAC maps permissions to roles; ABAC evaluates attributes for fine-grained, context-aware decisions. Enforce least privilege, prefer just-in-time elevation over standing admin rights, vault privileged credentials in a PAM system, and scope service accounts narrowly with rotation.

Lifecycle

Identity proofing → provisioning (SCIM automates it) → periodic recertification → deprovisioning. Orphaned accounts are a top audit finding, and the mover step - not the leaver step - is where excess access usually accumulates.

Worked example

"Users need one login across SaaS apps, and each app must know who the user is." Choose OIDC: the ID token authenticates the user to the application. If instead a third-party app needs to read calendar data without ever seeing the password, that is OAuth authorization with scoped, revocable tokens - no identity assertion required.

Traps

OAuth is not authentication. Two passwords are not MFA. RADIUS fits network admission, TACACS+ fits router and switch administration. Disabling accounts on the employee's last day rather than at termination leaves a live credential during the highest-risk window.