Identity and Access Management (IAM) Concepts
Four steps, four different questions
Identification is the claim ("I am Alice"). Authentication proves it. Authorization decides what the proven identity may do. Accounting records what happened. Many candidates lose marks by answering "authentication" for a scenario about permissions; authorization always follows authentication, and single sign-on changes convenience, not the underlying checks.
Factors and MFA
Factors are something you know (password, PIN), have (token, smart card, phone), are (fingerprint, face), do (signature, gait) and somewhere you are (geolocation). True MFA combines different types; two passwords or a password plus a PIN is one factor twice. Biometrics trade off FAR and FRR - loosen the threshold and false accepts rise while false rejects fall; the crossover is the CER/EER. Passwords should be long, screened against breached lists, salted and hashed with a slow algorithm, never encrypted or stored in plaintext.
Models and lifecycle
DAC: the resource owner grants access. MAC: labels and clearances set by a central authority. RBAC: permissions go to roles, users go to roles - usually the best enterprise answer. ABAC/rule-based: decisions from attributes and policy (department, time, location). Pair any model with least privilege, separation of duties and privileged access management for admin accounts. The lifecycle is join/move/leave: provisioning on hire, adjustment on transfer, prompt deprovisioning on termination - the most common real-world gap.
Rule of thumb
Read the verb. "Prove," "verify," "log in" = authentication. "Allowed," "permitted," "can open" = authorization. If the file's owner grants access it is DAC; if a policy using department and time decides, it is ABAC.