CompTIA Security+ SY0-701 · Free study guide

Objective 4.6 — Implement and maintain identity and access management

Identity and access management is a lifecycle. Identity proofing establishes that an applicant is the claimed person or entity before an account or credential is issued. An authoritative source then drives provisioning, permission changes, review, and prompt deprovisioning. Periodic attestation asks an accountable reviewer to affirm or correct identities and entitlements using current business facts. Dormant accounts and inherited permissions show where the lifecycle failed.

Authentication factors come from something known, possessed, inherent, or associated with location—something you know, have, are, or somewhere you are. Multifactor authentication uses different factor categories; a password and PIN are still one knowledge category. Location can strengthen a contextual decision, but spoofing and travel make it weaker than a protected cryptographic factor in many designs. Biometrics have false acceptance and rejection tradeoffs and should include liveness, privacy, enrollment, and fallback planning. Passwordless authentication can use device-bound cryptographic credentials, reducing shared-secret exposure.

Where passwords remain, prefer long, unique values, block known-compromised choices, prevent unsafe reuse, protect recovery, and apply the organization's approved age or expiration rules. A password manager can generate and store unique credentials, but its vault, recovery method, device access, and synchronization need strong protection. Complexity rules do not compensate for short or reused secrets.

Federation and authorization

Single sign-on reduces repeated authentication within an environment. Federation extends identity trust across organizational or system boundaries. SAML commonly carries authentication assertions for browser enterprise applications; OAuth delegates scoped authorization; OpenID Connect adds an identity layer to OAuth. LDAP provides directory access. Know what each protocol proves and validate issuer, audience, signature, expiry, redirect, and scope.

Authorization models fit different needs. Role-based access follows job functions. Attribute-based access evaluates subject, resource, action, and environment attributes. Rule-based access applies system-defined conditions. Mandatory access control uses centrally assigned labels; discretionary access control lets an owner grant permissions within policy.

Privileged access management protects administrative credentials and sessions. Password vaulting controls retrieval and rotation of reusable secrets. Ephemeral credentials expire after a short task or session and reduce the lifetime of stolen material. Just-in-time access grants privilege only when needed; time-based restrictions limit when access works. None replaces identity proofing, approval, monitoring, attestation, or separation of duties. Service accounts need ownership, scoped permissions, protected secrets or workload identity, rotation, and noninteractive controls.

Provisioning and deprovisioning should follow authoritative employment or contract events. Review group membership, direct grants, role conflicts, unused privilege, shared accounts, and emergency access. An access review is meaningful only when reviewers understand the entitlement and act on findings.

Decision rule: use authoritative identity, independent factors, least privilege, explicit trust, lifecycle automation with safeguards, and prompt removal backed by audit evidence.