Identity and Access Management
What this domain tests
Identity and Access Management tests how identities are proven, authorized, federated, and governed. Expect questions on MFA, phishing-resistant authenticators, SSO, SAML versus OIDC, RBAC and ABAC, privileged access management, and joiner-mover-leaver processes.
Core rules
- Identification claims an identity; authentication proves it; authorization decides what it may do; accounting records activity.
- Phishing-resistant MFA uses FIDO2/WebAuthn security keys or passkeys bound to the origin. SMS and push approvals are weaker against real-time phishing and MFA fatigue.
- SSO centralizes authentication but is not authorization; downstream applications still enforce roles.
- SAML is widely used for browser SSO; OIDC adds an identity layer on OAuth 2.0, which is an authorization framework.
- RBAC assigns permissions through roles; ABAC evaluates attributes; PAM vaults privileged credentials and supports just-in-time elevation.
Worked example
A contractor needs read-only access to one analytics dashboard for 30 days. Create a federated identity, require phishing-resistant MFA, assign a scoped role, set an expiration, and log access. Do not issue a shared local account or a standing admin role. Review the grant before expiry and revoke automatically.
Traps that cost marks
- Saying OAuth 2.0 authenticates users; it authorizes API access, while OIDC handles authentication.
- Assuming SSO grants permissions.
- Confusing role explosion with least privilege: too many custom roles become unmanageable.
- Forgetting that MFA does not stop token theft or consent phishing.