Security+
4.6Security Operations · 28% of exam

Given a scenario, implement and maintain identity and access management

Provisioning, federation, SSO, LDAP, OAuth, SAML, MFA factors, password policy, and privileged access management.

Reading time
30 min read
Flashcards
26 cards
Practice questions
12 questions · 3 PBQs

Identity is the perimeter now — 1.2's zero trust makes that explicit. This objective is large, but it is mostly a set of distinctions, and the exam tests the same handful every time.

The account lifecycle

Provisioning → permission assignment → periodic attestation → de-provisioning.

Identity proofing

Verifying someone is who they claim before an account exists. Checking identity documents at onboarding.

Provisioning

Creating the account and granting initial access.

Attestation

Periodic review where managers confirm their people still need the access they hold. This is what catches privilege creep.

De-provisioning

Disabling and removing access on departure or role change.

Check yourself

An employee transfers from finance to marketing. What should happen to their access?

Access control models

Five models, and the exam tests the boundaries between them.

DAC — Discretionary

  • The data OWNER decides who gets access
  • Flexible, common in file systems
  • Owner can grant to anyone

MAC — Mandatory

  • The SYSTEM enforces labels and clearances
  • Owner cannot override
  • Military and classified environments

The tellWho decides? Owner discretion is DAC. System-enforced labels the owner cannot override is MAC.

RBAC — Role-based

Access follows your job role. You are in the Accounts Payable role, so you get its permissions. The most common model in business.

Rule-based

Access follows rules the administrator sets, applied to everyone. A firewall ACL is the classic example. Note the confusing acronym clash with role-based.

ABAC — Attribute-based

Access is evaluated from multiple attributes — department, location, device, time, sensitivity. The most granular and flexible, and the natural fit for zero trust.

Time-of-day restrictions and least privilege apply across all models. Least privilege is the single most frequently correct principle on the whole exam: grant the minimum access needed to do the job, and nothing more.

Federation and SSO

SSO

Single sign-on. Authenticate once, access many systems, within one trust domain.

Federation

Extending identity across organisational boundaries — logging into a supplier's portal with your own company credentials. SSO between organisations rather than within one.

The three protocols, and what each is actually for:

LDAP

  • Directory protocol
  • Queries a directory for users, groups, attributes
  • Active Directory speaks it

SAML

  • XML-based
  • Authentication and authorisation
  • Classic enterprise web SSO

OAuth

  • AUTHORISATION, not authentication
  • Delegated access without sharing the password
  • OIDC adds authentication on top

The tellOAuth authorises, SAML authenticates and authorises, LDAP looks things up. 'Sign in with Google' is OAuth plus OpenID Connect.

Multifactor authentication

Factors, not instances. Two passwords are not two factors.

FactorMeaningExamples
Something you knowKnowledgePassword, PIN, security question
Something you havePossessionToken, smart card, phone, security key
Something you areInherenceFingerprint, face, iris
Somewhere you areLocationGPS, network location

Check yourself

A system requires a password and then a security question. Is this multifactor?

Implementations worth knowing: hard tokens (physical devices), soft tokens (authenticator apps generating TOTP codes), security keys (FIDO2/hardware keys — the most phishing-resistant option), biometrics, and SMS codes, which are the weakest because of SIM swapping.

Passwords

Current guidance, which has shifted and which the exam has followed:

  • Length beats complexity. A long passphrase resists cracking better than a short string with symbols.
  • Forced periodic expiration is discouraged. It drives predictable patterns like Summer2026! becoming Autumn2026!. Rotate on evidence of compromise instead.
  • Reuse is the real danger. One breached site compromises every account sharing that password. This is credential stuffing.
  • Password managers are recommended: they make long, unique, random passwords practical.
  • Passwordless — passkeys, biometrics, hardware keys — removes the credential an attacker could phish at all.

Privileged access management

Admin accounts are the highest-value target, so PAM treats them differently:

Password vaulting

Privileged credentials are held in a vault and checked out when needed, rather than known by individuals.

Just-in-time permissions

Elevated rights granted only for the moment they are needed, then automatically removed. Nobody holds standing admin.

Ephemeral credentials

Credentials that exist briefly and expire automatically, so a stolen one is worthless within minutes.

The shared idea: standing privilege is the risk. An admin account that is always privileged is always a target. If a stem describes reducing the window in which stolen admin credentials are useful, just-in-time and ephemeral credentials are the answers.

Check yourself

A company wants administrators to hold no standing elevated rights, receiving them only for approved windows. Which PAM capability is this?