Security+ topic 4.5
Identity and Access Management
Identity and access management (IAM) controls who gets in and what they can do. Accounts are provisioned when people join and deprovisioned when they leave. Multifactor authentication (MFA) combines something you know, have, are, or somewhere you are. Single sign-on (SSO) and federation with SAML or OpenID Connect let one login reach many apps, even across organizations. Access control models include role-based (RBAC), attribute-based (ABAC), mandatory (MAC) and discretionary (DAC). Privileged access management (PAM) adds just-in-time access and password vaulting for admins. Watch for privilege creep, where users collect access they no longer need, and use group managed service accounts (gMSA) so service account passwords rotate automatically.
Identity and Access Management vocabulary
- Multifactor authentication (MFA): Logging in with two or more different kinds of factors, such as a password and a phone.
- Single sign-on (SSO): One login that gives access to many applications.
- Privilege creep: A user slowly collecting more access than their current job needs.
- Privileged access management (PAM): Tools that tightly control and monitor admin accounts, such as just-in-time access.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. Which of the following is an example of multifactor authentication?
- (A) A password and a PIN
- (B) A password and a code from an authenticator app
- (C) Two different passwords
- (D) A username and a password
Show answer
(B) A password and a code from an authenticator app MFA needs different factor types: something you know and something you have.
2. An employee has moved through four departments and still has access to all of them. Which of the following describes this problem?
- (A) Privilege creep
- (B) Impossible travel
- (C) Shadow IT
- (D) Key stretching
Show answer
(A) Privilege creep Collecting more access than the current job needs is privilege creep.
3. Admins receive elevated rights only for one hour when they request them for a ticket, and the rights are then removed. Which of the following is this?
- (A) Just-in-time access through PAM
- (B) Single sign-on
- (C) Discretionary access control
- (D) Federation
Show answer
(A) Just-in-time access through PAM Privileged access management can grant temporary, just-in-time rights.
4. A company wants service accounts whose passwords are managed and rotated automatically by the directory. Which of the following should it use?
- (A) Group managed service accounts
- (B) Shared admin accounts
- (C) Guest accounts
- (D) Local accounts with passwords that never expire
Show answer
(A) Group managed service accounts gMSAs let the directory rotate service account passwords automatically.