Access Control and Identity Management
Core ideas
Access control decides who can do what to which resource. The main models are DAC (owner sets permissions), MAC (labels/clearances enforced by the system), RBAC (roles carry permissions), and ABAC (attributes/policy drive decisions). Know the AAA cycle: authentication, authorization, accounting. Authentication factors are something you know, have, or are; MFA combines distinct types.
Concepts to master
Identification vs. authentication vs. authorization. Single sign-on (SSO) and federation (SAML, OAuth/OIDC), directory services (LDAP), and credential stores. Session management, password policy, and account lifecycle (provisioning, review, deprovisioning). Privileged access management and just-in-time access. Physical access controls and biometric error rates (FAR/FRR, CER).
Traps
Two passwords are not MFA (same factor type). Authentication proves identity; authorization grants rights-don't conflate. RBAC assigns permissions to roles, not users directly. In biometrics, a low CER is better; a low FAR means fewer false acceptances (more secure) but may raise FRR.
Worked example
A user logs in with a password and a hardware token code. Password = know; token = have. Two distinct factors, so this is MFA. If they used two different passwords, it would be single-factor repeated.
Rule of thumb: when a question asks "which model?" check whether the decision is based on identity attributes (ABAC), job function (RBAC), labels (MAC), or owner discretion (DAC).