CompTIA Security+ Preparation · lesson 28 of 45 · 25 min
Identity and Access Management Fundamentals
Identity and Access Management (IAM) is the framework of policies and technologies that ensures the right people have the right access to the right resources at the right time. It is the foundation of Zero Trust and one of the most tested Security+ domains.
IAM covers authentication (proving who you are), authorization (what you are allowed to do), and accounting/auditing (tracking what you did).
Authentication Factors
MFA
Multi-Factor Authentication (MFA) requires two or more factors from different categories. A password + SMS code is MFA (know + have). A password + security question is NOT MFA — both are “something you know.”
Access Control Models
Key IAM Concepts
Flashcard Drill
MFA Multi-Factor Authentication — two or more factors from different categories (know + have + are). RBAC Role-Based Access Control — access granted based on job role. MAC Mandatory Access Control — system enforces access based on classification labels. Least privilege Grant only the minimum access needed to perform a task. Separation of duties No single person controls an entire critical process — requires collusion to commit fraud. PAM Privileged Access Management — controls for admin accounts including vaulting and session recording. SSO Single Sign-On — one authentication grants access to multiple systems. Federation Trust relationship between identity providers allowing cross-domain authentication. Account deprovisioning Removing access when an employee leaves — critical to prevent orphaned accounts. ABAC Attribute-Based Access Control — fine-grained access based on user, resource, and environment attributes.
Scenario Practice
The Orphaned Account
This is normal — accounts should stay active for 6 months after departure. This is an orphaned account security failure. Deprovisioning should have occurred on the last day. The accesses are likely unauthorized. The former admin is allowed to access systems as a contractor. This is a false positive — the account was probably used by IT. 1 Orphaned accounts are a critical IAM failure. Deprovisioning must happen on or before the employee’s last day. The post-departure accesses are a serious incident requiring investigation.
Knowledge Check
IAM — 10 Questions
A password combined with a fingerprint scan is an example of:
- Single-factor authentication
- Multi-factor authentication
- Single sign-on
- Federation
- Answer: Multi-factor authentication
Password (know) + fingerprint (are) = two different factor categories = MFA.
Which access control model grants access based on job role?
- DAC
- MAC
- RBAC
- ABAC
Answer: RBAC
RBAC assigns permissions to roles; users inherit permissions by being assigned to a role.
A password + security question combination qualifies as MFA because two credentials are required.
- True
- False
Answer: False
Both a password and a security question are “something you know” — the same factor category. MFA requires factors from different categories.
The principle that no single person should control an entire critical process is called separation of _____.
Answer: duties
Separation of duties prevents fraud and errors by requiring multiple people to complete critical processes.
Which IAM concept provides special controls for administrator accounts including session recording and just-in-time access?
- SSO
- PAM
- RBAC
- Federation
Answer: PAM
PAM (Privileged Access Management) provides enhanced controls for high-privilege accounts.
MAC (Mandatory Access Control) is primarily used in:
- Home networks
- Government and military classified systems
- Small business file servers
- Cloud SaaS applications
- Answer: Government and military classified systems
MAC uses classification labels (Top Secret, Secret, Confidential) enforced by the system — used in government/military environments.
Which are examples of “something you have” authentication factors? (Select all that apply)
- Password
- YubiKey hardware token
- Fingerprint
- Smart card
- Google Authenticator OTP
Answer: YubiKey hardware token
Smart card
Google Authenticator OTP Hardware tokens, smart cards, and OTP apps are possession factors. Passwords are knowledge; fingerprints are biometric.
SSO (Single Sign-On) provides which benefit?
- Stronger passwords
- One authentication event grants access to multiple systems
- Eliminates the need for MFA
- Encrypts all user data
Answer: One authentication event grants access to multiple systems
SSO reduces authentication friction — users authenticate once and access all authorized systems.
Deprovisioning an account should happen on or before an employee’s last day.
- True
- False
Answer: True
Accounts must be disabled/removed on the last day to prevent unauthorized access by former employees.
Federation allows:
- Users to have multiple passwords
- Cross-domain authentication using a trust relationship between identity providers
- Admins to access all systems
- Automatic account provisioning
- Answer: Cross-domain authentication using a trust relationship between identity providers
Federation establishes trust between IdPs — e.g. “Login with Google” on a third-party site uses Google as the federated IdP.
Previous lesson: Infrastructure as code (IaC) and secure DevOps: CI/CD pipeline security, SAST, DAST
Back to CompTIA Security+ Preparation
Next lesson: Endpoint security: EDR, DLP, application control, hardening