Identity and Access Management
Given a scenario, implement and maintain identity and access management
What you will learn
- Explain the account lifecycle and know which stage is most dangerously neglected.
- Separate the four access control models and who decides in each.
- Know the three authentication factors and tell real multi-factor from fake.
- Explain privileged access management and why ephemeral credentials beat standing ones.
Identity is the new perimeter. When a device's location on the network is no longer evidence of trust — as in Zero Trust from objective 1.2 — the only question left is who you are and what you may do. That is why this objective carries so much weight in the domain.
The account lifecycle
Provisioning
With identity proofing, and the least privilege the role needs.
Modification on role change
This is where privilege creep happens: the employee moves, new permissions are added, and the old ones are never removed.
Periodic attestation
Managers periodically certify that their teams' permissions are still required.
Deprovisioning
Immediately on departure. A leaver's abandoned account is the best possible entry point — it raises no suspicion and nobody watches it.
Access control models
| DAC | Discretionary: the resource owner grants access. Flexible and hardest to govern. |
|---|---|
| MAC | Mandatory: the system enforces labels and the owner cannot override them. Military and government environments. |
| RBAC | Role-based: permissions attach to a role and users are assigned to it. The commonest in organisations because it scales. |
| ABAC | Attribute-based: the decision comes from user, resource and context attributes — time, location, device posture. The most precise and the most complex. |
Authentication and factors
| Something you know | A password, a PIN, a question. |
|---|---|
| Something you have | A phone, a hardware token, a security key. |
| Something you are | A fingerprint, a face, an iris. |
| SSO | Single sign-on: one authentication for many systems. It eases the user's life and makes that one account a single high-value target. |
| Federation | Trusting an identity issued by another party — SAML and OAuth are its best-known mechanisms. |
| PAM | Privileged access management: a password vault, just-in-time granting, and ephemeral credentials that expire on their own. |
Two of the same kind are not multi-factor
A password and a security question are both "something you know", so whoever stole one usually knows the other. Multi-factor requires different kinds: know + have, or know + are. If a question describes two factors from the same category, that is two-step single-factor authentication, not multi-factor.
Real-world example: privilege creep
An employee has spent six years across three departments: support, then procurement, then finance. At each move the new role's permissions were added and the old ones never removed — because removal requires a request and addition requires a request, and nobody requests removal. Today her account can open support tickets, approve purchase orders and execute payments. Nobody broke a policy, and the result is one account that can raise a purchase, approve it and pay it. The remedy is periodic attestation where a manager certifies what is actually needed, not an audit after the incident.
What matters on the exam
- "A leaver whose account still works" = a deprovisioning failure, the lifecycle's most dangerously neglected stage.
- Permissions accumulating across moves = privilege creep, remedied by periodic attestation, not a later audit.
- RBAC when permissions attach to a role; ABAC when the question mentions time, location or device posture.
- SSO concentrates risk: its account deserves the strongest multi-factor, because compromising it opens everything.
Quick check
Answer in your head first, then reveal.
A password plus a security question: is that multi-factor?Reveal the answer
No. Both are "something you know" — one kind in two steps. Multi-factor needs a different kind: something you have, or something you are.
What separates RBAC from ABAC?Reveal the answer
RBAC grants permissions to a role and the user inherits them — simple and manageable. ABAC decides from multiple attributes including context: time, location, device posture — more precise and more complex.
Why is just-in-time access safer than standing administrative privilege?Reveal the answer
Because the window shrinks: the privilege exists for minutes when needed instead of being permanently available to whoever steals the account. And each grant is requested and logged, creating an auditable trail.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.