I85PREP
⌘ K
CS AO study materials
CS AO study resources

CS AO: User and Access Management

CS AO · Work through your exam, one topic at a time.

All guide sections

User and Access Management

User and Access Management

This domain tests identity lifecycle and authorization: creating accounts, assigning rights, proving who did what, and removing access when roles change.

Core rules

  • Linux identity: /etc/passwd (UID, GID, shell), /etc/shadow (hash, aging), /etc/group. UID 0 is root; system accounts typically below 1000. Use useradd -m -s /bin/bash, usermod -aG, and passwd -l to lock.
  • sudo policy lives in /etc/sudoers and /etc/sudoers.d/; edit with visudo. Grant specific commands, not ALL=(ALL) ALL, and require a TTY.
  • PAM enforces password quality (pam_pwquality), lockout (pam_faillock), and MFA (pam_google_authenticator).
  • Windows/AD: users and groups in OUs, Group Policy for password and lockout policy, Kerberos for authentication. Use role-based groups, never per-user permissions.
  • Lifecycle: joiner/mover/leaver. Disable on the day of exit, retain data per policy, review privileged groups quarterly.

Worked example

A contractor needs to restart one service. Reasoning: do not add them to a broad admin group. Create group svc-restart and add a sudoers drop-in: %svc-restart ALL=(root) NOPASSWD: /bin/systemctl restart nginx. Validate with visudo -cf, then test as the contractor. Record the approval ticket. On contract end, remove group membership and confirm with id.

Traps

  • Editing /etc/passwd directly instead of using vipw.
  • Using usermod -G instead of -aG, which drops existing groups.
  • Shared admin accounts - they destroy attribution.
  • Leaving disabled accounts with valid SSH keys.