Identity and Access Management
Identity and Access Management tests the full lifecycle: identifying a subject, authenticating it, authorizing actions, and accounting for what happened. GCT-2A-324 questions often hinge on precise distinctions - authentication versus authorization, OAuth versus OpenID Connect, role assignment versus entitlement review - and on controlling privileged and temporary access.
Core rules and concepts
- Identification claims an identity; authentication verifies it; authorization decides access; accounting records activity.
- Authentication factors are something you know, have, or are. MFA combines different factor types. FIDO2/WebAuthn security keys are phishing-resistant because the credential is bound to the origin.
- Federation uses SAML assertions or OpenID Connect ID tokens. OAuth 2.0 is a delegated authorization framework, not an authentication protocol; OIDC adds the identity layer. SCIM automates provisioning and deprovisioning.
- RBAC assigns permissions to roles; ABAC evaluates attributes and context. Least privilege, separation of duties, and just-in-time (JIT) access reduce standing entitlement.
- Privileged access management vaults credentials, brokers sessions, and records privileged activity. Joiner-mover-leaver processes must remove access promptly; orphan and dormant accounts are audit findings.
Worked example
A contractor needs read access to a production analytics dashboard for 30 days. Giving the contractor a permanent analyst role fails least privilege. The better design uses a defined contractor role with read-only dashboard permission, JIT activation approved by the data owner, MFA with a phishing-resistant authenticator, and an expiry date. The identity is federated so the contractor uses their home organization’s login, and SCIM disables the account when the contract ends. Access is reviewed at day 14 and again at day 30. The reasoning: authorization is scoped to the task, time-bound, and independently reviewed; federation does not remove the need for local authorization.
Traps that cost marks
- Calling OAuth 2.0 an authentication protocol; use OIDC when identity is required.
- Treating VPN or network location as authorization for an application action.
- Leaving shared or service accounts unowned and outside MFA and rotation.
- Assuming MFA stops all phishing; push fatigue and adversary-in-the-middle attacks require number matching or phishing-resistant methods.