Access Control and Identity Management
Domain 2 tests identity lifecycle control: how subjects are identified, authenticated, authorized, and held accountable. Key topics include AAA, multifactor authentication, RBAC, ABAC, MAC, DAC, single sign-on, federation, privileged access management, and joiner-mover-leaver processes.
Core rules
- Identification claims an identity; authentication verifies it; authorization decides permitted actions; accounting records what happened. Do not collapse these stages.
- MFA combines factors from different categories: knowledge, possession, and inherence. Two passwords are not MFA.
- RBAC grants permissions through roles; ABAC evaluates attributes such as department, device posture, time, and resource sensitivity. MAC uses system-enforced labels; DAC lets resource owners grant access.
- Access reviews, recertification, and timely revocation are controls, not paperwork. Group nesting can hide excessive entitlements.
- Privileged accounts need separate administration, strong authentication, session logging, and just-in-time elevation.
Worked example
A contractor needs temporary access to a finance reporting share for a 30-day project. The weak answer is to add the contractor to a broad finance group. The defensible answer is a sponsor-approved, time-bound role scoped to the reporting share, with MFA, an expiry date, logging, and a review before expiry. The reasoning is least privilege plus accountability: the entitlement is limited in scope and duration, and removal does not depend on someone remembering.
Traps
Do not confuse authentication with authorization. Do not assume SSO removes the need for per-application authorization. Do not accept shared accounts, standing admin rights, or orphaned accounts as harmless.