Certified Information Systems Security Professional (CISSP) Identity and Access Management (IAM) Syllabus

Identity and Access Management (IAM) syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Identity and Access Management (IAM) in Certified Information Systems Security Professional (CISSP), not a summary of it.

1. 1

   Identification and Authentication

   3 topics

   • Authentication Factors
     • Something you know, have, and are
     • Multifactor authentication design
     • Knowledge-based and location-based factors
   • Biometric Systems
     • Physiological and behavioral biometrics
     • FAR, FRR, and crossover error rate
     • Enrollment, throughput, and acceptability
   • Credential Management
     • Password policies and passphrases
     • Password managers and vaulting
     • Just-in-time provisioning
2. 2

   Access Control Models and Mechanisms

   3 topics

   • Access Control Models
     • Discretionary access control (DAC)
     • Mandatory access control (MAC)
     • Role-based and rule-based access control
     • Attribute-based and risk-based access control
   • Authorization Concepts
     • Access control lists and capability tables
     • Least privilege and separation of duties enforcement
     • Privileged access management
   • Accountability and Auditing
     • Logging access events
     • Session management and timeouts
     • Access review and recertification
3. 3

   Identity Management Across Environments

   4 topics

   • Identity Lifecycle Management
     • Provisioning, modification, and deprovisioning
     • Identity proofing and registration
     • Account types: user, service, privileged
   • Single Sign-On and Federation
     • SSO benefits and risks
     • SAML, OAuth 2.0, and OpenID Connect
     • Federated identity and trust relationships
   • Directory and Authentication Services
     • LDAP and Active Directory
     • Kerberos tickets and realms
     • RADIUS, TACACS+, and Diameter
   • Identity as a Service and Cloud IAM
     • IDaaS models
     • Just-in-time access to cloud resources
     • Credential management for third parties

Identity and Access Management (IAM) flashcards for Certified Information Systems Security Professional (CISSP)

22 of 51 cards from the Identity and Access Management (IAM) deck — real questions with worked answers.

1. What are the three primary categories of authentication factors?

   Type 1 - something you know (knowledge, e.g., password/PIN); Type 2 - something you have (possession, e.g., token/smart card); Type 3 - something you are (biometric, e.g., fingerprint).

2. In authentication, what are the two additional factor categories beyond knowledge, possession, and biometric?

   Type 4 - somewhere you are (location, e.g., GPS/IP geolocation); and something you do (behavior, e.g., keystroke dynamics or signature pattern).

3. What distinguishes multifactor authentication (MFA) from using two of the same factor type?

   True MFA combines factors from two or more DIFFERENT categories (e.g., password + token). Using two passwords, or two knowledge items, is single-factor (multi-step), not multifactor.

4. What is the difference between identification and authentication?

   Identification is claiming an identity (e.g., entering a username); authentication is proving that claimed identity is genuine (e.g., providing a password or biometric).

5. In biometrics, what are the False Rejection Rate (FRR) and False Acceptance Rate (FAR), and which error types are they?

   FRR (Type I error) - a legitimate user is wrongly rejected. FAR (Type II error) - an impostor is wrongly accepted. FAR is the more dangerous security error.

6. What is the Crossover Error Rate (CER) in biometrics and why does it matter?

   CER (Equal Error Rate) is the point where FRR equals FAR, expressed as a percentage. A lower CER indicates a more accurate biometric system and is the standard metric for comparing systems.

7. How does adjusting a biometric system's sensitivity affect FAR and FRR?

   Increasing sensitivity raises FRR (more false rejections) but lowers FAR; decreasing sensitivity lowers FRR but raises FAR. They trade off inversely.

8. In biometric system processing, what are enrollment and throughput?

   Enrollment is the initial registration of a user's biometric to create a reference template. Throughput is the rate at which the system processes and authenticates users (acceptable target generally under ~6 seconds).

9. What biometric methods are generally considered most accurate?

   Iris scans and retina scans are among the most accurate. Iris is preferred for being less invasive and more stable over time; retina scans can reveal health information, raising privacy concerns.

10. What is the purpose of password salting?

    A salt is random data added to a password before hashing so identical passwords produce different hashes. It defeats precomputed rainbow table attacks and makes brute-forcing each hash unique.

11. What is the difference between password complexity, length, and a passphrase?

    Complexity requires varied character sets (upper/lower/digits/symbols); length is the number of characters; a passphrase is a long sequence of words. Length generally contributes more to strength than complexity.

12. What are cognitive passwords and their main weakness?

    Cognitive passwords are knowledge-based authentication using personal questions (e.g., mother's maiden name). Their weakness is that answers are often publicly discoverable or guessable via social engineering.

13. What is the difference between a synchronous and an asynchronous (dynamic) token?

    A synchronous token generates one-time passwords based on time or an event counter synchronized with the server (e.g., TOTP). An asynchronous token uses challenge-response: the server issues a challenge the token must compute a response to.

14. What is account provisioning and deprovisioning in the identity lifecycle?

    Provisioning is creating and granting accounts/access when a user joins or changes roles; deprovisioning is promptly disabling/removing access when a user leaves or no longer needs it, preventing orphaned accounts.

15. What is the principle behind regular user access reviews (recertification)?

    Periodically verifying that each user's privileges still match their job needs, removing accumulated excess access. It counters privilege creep (authorization/aggregation creep).

16. What is privilege creep (authorization creep)?

    The gradual accumulation of access rights beyond what a user needs, typically as they change roles without old permissions being revoked. It violates least privilege.

17. Define the principle of least privilege.

    Subjects should be granted only the minimum access rights and permissions necessary to perform their job functions, and no more.

18. What is the principle of need-to-know and how does it relate to least privilege?

    Need-to-know restricts access to specific data/resources required for a task. Least privilege is broader (rights and permissions); need-to-know focuses specifically on access to information.

19. In Discretionary Access Control (DAC), who determines access and how is it implemented?

    The data owner has discretion to grant access to objects they own, typically implemented via Access Control Lists (ACLs). It is identity-based and flexible but harder to centrally control.

20. What characterizes Mandatory Access Control (MAC)?

    Access is enforced by the system based on security labels (clearances for subjects, classifications for objects) defined by central policy. Users cannot alter labels; used in high-security/military environments. It is non-discretionary and lattice-based.

21. How does Role-Based Access Control (RBAC) assign permissions?

    Permissions are assigned to roles, and users are assigned to roles based on job function. Users inherit role permissions. It eases administration in environments with high turnover.

22. What is Rule-Based Access Control?

    Access is governed by a set of global rules/conditions applied to all subjects (e.g., firewall ACLs allowing traffic from certain ports/times). The rules, not individual identity, determine access.

See more Identity and Access Management (IAM) flashcards →

Planning Identity and Access Management (IAM) for Certified Information Systems Security Professional (CISSP)

Identity and Access Management (IAM) (Certified Information Systems Security Professional (CISSP)) FAQ