4.6 Given a scenario, implement and maintain identity and access management

Domain 4: Security Operations

Identity and access management is one of the densest operational objectives. Cover the full account lifecycle: provisioning, permission assignment, identity proofing, and deprovisioning when someone leaves or changes roles. Know federation and single sign-on, and the protocols behind them — LDAP for directory access, OAuth for authorization, SAML and OpenID Connect for federated authentication. Access control models are heavily tested: mandatory, discretionary, role-based, rule-based, and attribute-based, plus time-of-day restrictions and least privilege. On the authentication side, understand multifactor categories (something you know, have, are, somewhere you are), token types, biometrics, and passwordless options like security keys. Password best practices now emphasize length over forced complexity churn, and password managers over reuse. Privileged access management tools bring just-in-time permissions, password vaulting, and ephemeral credentials. Candidates most often confuse the access models — RBAC assigns permissions to roles, ABAC evaluates attributes and context — and forget that deprovisioning promptly is the control that prevents orphaned accounts from becoming attack paths.

common pitfall · Candidates blur the access control models, especially picking RBAC when the scenario describes attribute- or context-based decisions that point to ABAC.