Identity and Access Management
Identity and Access Management tests how identities are proven, authorized, federated, and governed. Expect questions on authentication factors, access control models, single sign-on protocols, and joiner-mover-leaver lifecycle controls.
Core rules and concepts
- Identification claims an identity; authentication proves it; authorization decides access; accounting records activity.
- Factors are something you know, have, and are; MFA requires different factor types. A password plus a PIN is still one factor type.
- DAC lets resource owners set access; MAC uses labels and clearances; RBAC grants by role; ABAC evaluates attributes such as department, device, and time. RBAC is simpler to audit; ABAC is more dynamic but harder to govern.
- Federation uses SAML assertions, OAuth 2.0 authorization, and OpenID Connect for authentication. OAuth 2.0 is an authorization framework, not an authentication protocol; OIDC adds an identity layer.
- Lifecycle controls: joiner provisioning, mover role cleanup, leaver revocation. Privileged access management vaults credentials and records sessions.
Worked example
A finance manager needs access to a reporting application only from a managed device during business hours. RBAC alone grants the “Finance Manager” role permanently and ignores device or time. ABAC can evaluate department = finance, device = managed, and time within business hours. The role grants the application entitlement, while the ABAC policy constrains the context. This combines coarse-grained RBAC with fine-grained ABAC and avoids creating a new role for every context.
Traps
Treating OAuth 2.0 as authentication; confusing SAML authentication assertions with authorization; granting mover access before removing old roles; and assuming SSO removes the need for per-application authorization.