Identity and access management
Domain 4: Security Operations · Not started
Main exam topics
Hardening; asset and vulnerability management; monitoring and alerting; identity and access management; automation; firewalls and endpoint protection; log interpretation; incident detection, containment, eradication and recovery; forensic evidence and chain of custody.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Account lifecycle
Provisioning creates accounts with only the access needed for the role. Access reviews periodically confirm access is still appropriate. When employees change roles, old permissions must be removed to prevent privilege creep. Deprovisioning disables accounts promptly on departure, ideally automatically from HR events.
Authentication
Multifactor authentication combines factors from different categories: something you know, have, are, or somewhere you are. A password plus a PIN is still one factor. Phishing-resistant methods such as FIDO2 security keys and passkeys beat SMS codes. Single sign-on lets users authenticate once using SAML or OpenID Connect; OAuth delegates authorization to apps.
Access control models
Discretionary access control lets owners grant access. Mandatory access control uses labels and clearances. Role-based access control assigns permissions to roles. Attribute-based access control evaluates attributes such as department, time, and location. Rule-based control applies system-wide rules, like firewall rules.
Privileged access
Privileged access management vaults admin credentials, issues just-in-time elevated access, and records sessions. Admins should use separate accounts for daily work and administration.
Know the difference: SAML vs. OAuth
| Aspect | SAML | OAuth |
|---|---|---|
| Main purpose | Authentication / SSO | Delegated authorization |
| Format | XML assertions | Access tokens |
| Typical use | Enterprise web SSO | App accesses API on user's behalf |
Saved