Identity, Access and Authentication
What this domain tests
Identity is the practical perimeter. This domain verifies that you can separate identification, authentication, authorization and accounting, choose the correct factor or protocol, and design lifecycle and privileged-access controls.
Core rules
- Factor categories: something you know, something you have, something you are - plus contextual signals such as location, device posture and behaviour. MFA requires different categories; two passwords are single-factor twice.
- Protocols: LDAP queries directories; Kerberos issues a TGT from the KDC and then service tickets for SSO in Active Directory; RADIUS handles network access (VPN, Wi-Fi), TACACS+ handles device administration with per-command authorization; SAML and OIDC federate web identity; OAuth 2.0 is delegated authorization, not authentication - pair it with OIDC for login.
- Access models: discretionary (owner decides), mandatory (labels and clearances), role-based (role to permission mapping), attribute-based (policy over many attributes), rule-based. Choose by granularity and scale.
- Lifecycle: joiner-mover-leaver, access recertification, dormant and orphan account review, segregation-of-duties checks.
- Privileged access management: credential vaulting, session recording, just-in-time elevation, no standing domain-admin rights.
- Strong authentication: phishing-resistant factors such as FIDO2/passkeys, conditional access, continuous session evaluation.
Worked example
A contractor needs read-only access to one SaaS analytics application for 90 days. Correct design: a named account federated via SAML to the corporate identity provider, assigned the RBAC role 'analytics-viewer' with start and end dates, phishing-resistant MFA enforced, and an access review at day 60. Reasoning: named gives accountability, federated gives one deprovisioning point, read-only gives least privilege, time-bound limits permission drift, and the review catches scope creep. A shared team login breaks accountability; permanent standing admin breaks least privilege.
Traps that cost marks
- Describing OAuth 2.0 as an authentication protocol.
- Counting two knowledge factors as MFA.
- Treating Kerberos and LDAP as interchangeable - one issues tickets, the other queries a directory.
- Enforcing authorization only in the user interface while the API remains open.
- Leaving service accounts with non-expiring passwords and interactive logon rights.