Given a scenario, implement and maintain identity and access management
Provisioning, federation, SSO, LDAP, OAuth, SAML, MFA factors, password policy, and privileged access management.
- Reading time
- 30 min read
- Flashcards
- 26 cards
- Practice questions
- 12 questions · 3 PBQs
Identity is the perimeter now — 1.2's zero trust makes that explicit. This objective is large, but it is mostly a set of distinctions, and the exam tests the same handful every time.
The account lifecycle
Provisioning → permission assignment → periodic attestation → de-provisioning.
Identity proofing
Verifying someone is who they claim before an account exists. Checking identity documents at onboarding.
Provisioning
Creating the account and granting initial access.
Attestation
Periodic review where managers confirm their people still need the access they hold. This is what catches privilege creep.
De-provisioning
Disabling and removing access on departure or role change.
Check yourself
An employee transfers from finance to marketing. What should happen to their access?
Access control models
Five models, and the exam tests the boundaries between them.
DAC — Discretionary
- The data OWNER decides who gets access
- Flexible, common in file systems
- Owner can grant to anyone
MAC — Mandatory
- The SYSTEM enforces labels and clearances
- Owner cannot override
- Military and classified environments
The tellWho decides? Owner discretion is DAC. System-enforced labels the owner cannot override is MAC.
RBAC — Role-based
Access follows your job role. You are in the Accounts Payable role, so you get its permissions. The most common model in business.
Rule-based
Access follows rules the administrator sets, applied to everyone. A firewall ACL is the classic example. Note the confusing acronym clash with role-based.
ABAC — Attribute-based
Access is evaluated from multiple attributes — department, location, device, time, sensitivity. The most granular and flexible, and the natural fit for zero trust.
Time-of-day restrictions and least privilege apply across all models. Least privilege is the single most frequently correct principle on the whole exam: grant the minimum access needed to do the job, and nothing more.
Federation and SSO
SSO
Single sign-on. Authenticate once, access many systems, within one trust domain.
Federation
Extending identity across organisational boundaries — logging into a supplier's portal with your own company credentials. SSO between organisations rather than within one.
The three protocols, and what each is actually for:
LDAP
- Directory protocol
- Queries a directory for users, groups, attributes
- Active Directory speaks it
SAML
- XML-based
- Authentication and authorisation
- Classic enterprise web SSO
OAuth
- AUTHORISATION, not authentication
- Delegated access without sharing the password
- OIDC adds authentication on top
The tellOAuth authorises, SAML authenticates and authorises, LDAP looks things up. 'Sign in with Google' is OAuth plus OpenID Connect.
Multifactor authentication
Factors, not instances. Two passwords are not two factors.
| Factor | Meaning | Examples |
|---|---|---|
| Something you know | Knowledge | Password, PIN, security question |
| Something you have | Possession | Token, smart card, phone, security key |
| Something you are | Inherence | Fingerprint, face, iris |
| Somewhere you are | Location | GPS, network location |
Check yourself
A system requires a password and then a security question. Is this multifactor?
Implementations worth knowing: hard tokens (physical devices), soft tokens (authenticator apps generating TOTP codes), security keys (FIDO2/hardware keys — the most phishing-resistant option), biometrics, and SMS codes, which are the weakest because of SIM swapping.
Passwords
Current guidance, which has shifted and which the exam has followed:
- Length beats complexity. A long passphrase resists cracking better than a short string with symbols.
- Forced periodic expiration is discouraged. It drives predictable patterns like
Summer2026!becomingAutumn2026!. Rotate on evidence of compromise instead. - Reuse is the real danger. One breached site compromises every account sharing that password. This is credential stuffing.
- Password managers are recommended: they make long, unique, random passwords practical.
- Passwordless — passkeys, biometrics, hardware keys — removes the credential an attacker could phish at all.
Privileged access management
Admin accounts are the highest-value target, so PAM treats them differently:
Password vaulting
Privileged credentials are held in a vault and checked out when needed, rather than known by individuals.
Just-in-time permissions
Elevated rights granted only for the moment they are needed, then automatically removed. Nobody holds standing admin.
Ephemeral credentials
Credentials that exist briefly and expire automatically, so a stolen one is worthless within minutes.
The shared idea: standing privilege is the risk. An admin account that is always privileged is always a target. If a stem describes reducing the window in which stolen admin credentials are useful, just-in-time and ephemeral credentials are the answers.
Check yourself
A company wants administrators to hold no standing elevated rights, receiving them only for approved windows. Which PAM capability is this?