Identity, Access, and Account Management

What is the main goal of identity and access management?

Ensure the right users have the right access, under appropriate conditions, for the necessary amount of time.

What are the four steps in the identity and access decision flow?

Identification → Authentication → Authorization → Accounting.

What is identification?

Claiming an identity, such as entering a username or presenting an ID.

What is authentication?

Proving a claimed identity using a password, token, biometric, or other factor.

What is authorization?

Determining which resources and actions an authenticated identity is permitted to access.

What is accounting in access management?

Recording activity such as logins, access attempts, and user actions.

What is the difference between authentication and authorization?

Authentication proves identity; authorization determines what that identity can do.

What are the five authentication factor categories?

Something you know, have, are, do, and somewhere you are.

What is an example of a knowledge authentication factor?

A password or PIN.

What is an example of a possession authentication factor?

A smart card, security token, key fob, or device.

What is an example of an inherence authentication factor?

A fingerprint, face scan, or iris scan.

What is multifactor authentication (MFA)?

Authentication using two or more different factor types.

Is a password plus a PIN considered MFA?

No. Both are knowledge factors.

Is a fingerprint plus a face scan considered MFA?

No. Both are biometric factors.

What are two examples of true MFA?

Password + hardware token; smart card + PIN.

Why is MFA important?

It reduces dependence on a single credential and helps protect privileged and remote access.

What risks or challenges can MFA create?

Account lockouts, weak recovery procedures, and pressure to bypass controls.

What are the three components of an access control decision?

Subject → Access Decision → Object.

What is a subject in access control?

A user, application, or process requesting access.

What is an object in access control?

A protected resource such as data, an application, system, network, or physical space.

What is the principle of least privilege?

Giving users only the access necessary to perform their jobs.

What is the need-to-know principle?

Allowing access only when information is required for a specific task.

What is implicit deny?

Denying access by default unless it is explicitly permitted.

What is separation of duties?

Dividing sensitive responsibilities so one person cannot control an entire process.

What is discretionary access control (DAC)?

An access model where the resource owner decides who can access it.

What is mandatory access control (MAC)?

An access model based on centrally enforced classifications and clearance levels.

What is role-based access control (RBAC)?

An access model that assigns permissions according to job roles.

What is rule-based access control?

An access model that allows or denies access using fixed rules, such as network restrictions.

What is attribute-based access control (ABAC)?

An access model that evaluates multiple attributes, such as user group, device, location, or time.

What is the difference between DAC, MAC, RBAC, and ABAC?

DAC: owner; MAC: classification; RBAC: job role; ABAC: attributes and conditions.

What are directory services?

Centralized systems for managing user accounts and security information across an organization.

What is single sign-on (SSO)?

Using one authentication event to access multiple approved resources.

What is identity federation?

Allowing identity or authorization relationships to extend across different organizations.

What are the three stages of the account lifecycle?

Joiner → Mover → Leaver.

What should happen when a new employee joins an organization?

Create an account, assign minimum necessary permissions, and enable MFA.

What should happen when an employee changes roles?

Review permissions, remove old access, and grant only the access required for the new role.

What should happen when an employee leaves an organization?

Disable the account, revoke remote access, recover devices or tokens, and review remaining permissions.

What is privilege creep?

The gradual accumulation of unnecessary permissions as users change roles or responsibilities.

How can organizations reduce risks from inactive or expired accounts?

Disable or delete old accounts, use automatic expiration, review memberships, and audit activity.

What controls help secure remote access?

Approved connection paths, user/IP/device/time restrictions, limits on concurrent use, and remote-login auditing.