I85PREP
⌘ K
NCJOSI study materials
NCJOSI study resources

NCJOSI: Identity and Access Management

NCJOSI · Work through your exam, one topic at a time.

All guide sections

Identity and Access Management

Identity and Access Management tests the lifecycle of an identity and the mechanisms that prove and limit what it can do. Expect questions on federated protocols, authorisation models, and the operational failures that create orphan accounts.

Core rules

  • AAA: identification, authentication, authorisation, and accounting. Authentication proves who; authorisation decides what; accounting records what happened.
  • Factors are something you know, have, or are, plus location and behaviour as context. Two passwords are not MFA.
  • Phishing-resistant MFA means FIDO2/WebAuthn or passkeys; SMS OTP is vulnerable to interception and SIM swap.
  • OAuth 2.0 is an authorisation framework that issues access tokens; OpenID Connect adds an authentication layer with an ID token. Do not describe OAuth as an authentication protocol.
  • SAML 2.0 exchanges signed XML assertions between an identity provider and a service provider; OIDC is the JSON/JWT equivalent for modern apps.
  • Kerberos uses tickets (TGT, service tickets) from a KDC; Kerberoasting abuses service account SPNs to request crackable tickets.
  • Authorisation models: RBAC by role, ABAC by attributes, and policy-based approaches; least privilege and separation of duties constrain all of them.
  • Joiner-mover-leaver process: provision on day one, adjust on role change, and revoke on the contractual end date, not on the last working day.

Worked example

A contractor from a third-party vendor needs the admin console two hours a week. Design: assign an RBAC role scoped to that console only; grant access through just-in-time elevation in a PAM tool with an approver and automatic expiry; require FIDO2 hardware keys; apply conditional access limiting sign-in to a managed device and approved network range; record the session; and set the account expiry to the contract end date so deprovisioning is automatic. Rights are time-bound, minimal, and evidenced, which is what an auditor will ask for.

Traps that cost marks

  • Describing OAuth 2.0 as an authentication standard.
  • Assuming a role change automatically removes old entitlements.
  • Relying on periodic reviews alone when automated expiry is available.
  • Confusing service accounts with shared human accounts; both need owners and rotation.