Study guide 4: Identity and access management
Domain 4: Security Operations · Not started
Main exam topics
Hardening; asset and vulnerability management; monitoring and alerting; identity and access management; automation; firewalls and endpoint protection; log interpretation; incident detection, containment, eradication and recovery; forensic evidence and chain of custody.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 90 minutes
By the end of this lesson you will be able to:
- Classify authentication factors and choose strong MFA
- Compare DAC, MAC, RBAC, ABAC and rule-based access
- Apply least privilege and privileged access management
- Explain directory services, SSO, SAML, OAuth and OpenID Connect
Topic 4A — Authentication
Factors are something you know (password), have (token, smart card) and are (biometric); location and behavior are attributes. MFA requires factors of different types — a password plus a PIN is still single-factor. Password policy now favors length, banned-password lists and managers over forced complexity. Passwordless options include FIDO2/WebAuthn passkeys. Biometrics are measured by false acceptance and false rejection rates; the crossover error rate compares devices.
Topic 4B — Authorization
Discretionary access control lets the owner grant rights. Mandatory access control uses labels and clearances set by policy. Role-based access control grants rights through job roles. Attribute-based access control evaluates attributes such as department, device and time. Rule-based control applies system-wide rules like firewall ACLs. Least privilege grants only what is needed; privileged access management adds just-in-time elevation, password vaulting and session recording for admin accounts.
Topic 4C — Identity management
Directory services (LDAP, Active Directory) store identities. Provisioning and deprovisioning tie accounts to HR events; attestation reviews confirm access remains appropriate. Single sign-on lets one authentication reach many apps. Federation extends trust across organizations: SAML exchanges XML assertions for web SSO, OAuth delegates authorization with tokens, and OpenID Connect adds authentication on top of OAuth. Kerberos issues tickets inside a Windows domain.
Saved