Access Control and Identity Management
Access Control and Identity Management
This domain tests how identities are proven, authorized, governed, and audited. Expect questions on authentication versus authorization, RBAC and ABAC, least privilege, separation of duties, MFA, federation, privileged access management, and the identity lifecycle.
Core rules
- Authentication proves identity; authorization decides access. A valid login does not imply permission to a resource.
- RBAC grants permissions through roles; ABAC evaluates attributes such as department, device posture, time, and resource sensitivity. RBAC is simpler to audit; ABAC is more granular and can reduce role explosion.
- Least privilege and separation of duties limit blast radius and fraud. Joiner-mover-leaver processes must revoke access promptly.
- MFA should be phishing-resistant where risk is high; FIDO2/WebAuthn security keys resist real-time phishing better than SMS or push approval.
- Federation uses SAML or OIDC to trust an identity provider. SSO improves usability but concentrates risk, so the IdP must be strongly protected.
- PAM vaults privileged credentials, brokers sessions, and supports just-in-time elevation with recording.
Worked example
A company has 400 roles because each application team requested a custom role. Auditors cannot review them. The fix is not more roles but attribute-based policies: permit read access when user.department equals resource.owner_department and device.compliant is true. The reasoning: ABAC collapses countless static roles into a policy evaluated at request time, but the attributes must be authoritative and the policy must be tested to avoid unintended grants.
Traps
- Confusing authentication with authorization on scenario questions.
- Treating MFA as phishing-proof; push fatigue and adversary-in-the-middle proxies defeat some methods.
- Allowing shared privileged accounts that destroy accountability.