Examius

🇺🇸 Certified Information Systems Security Professional (CISSP) · subject

Certified Information Systems Security Professional (CISSP) Identity and Access Management (IAM) Syllabus

The Identity and Access Management (IAM) syllabus for Certified Information Systems Security Professional (CISSP) in full: 3 chapters, 10 topics and 31 sub-topics, every one listed below, plus 51 Identity and Access Management (IAM) flashcards with answers.

3Chapters
10Topics
31Sub-topics
51Flashcards

Identity and Access Management (IAM) syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Identification and Authentication

     3 topics
    • Authentication Factors
      • Something you know, have, and are
      • Multifactor authentication design
      • Knowledge-based and location-based factors
    • Biometric Systems
      • Physiological and behavioral biometrics
      • FAR, FRR, and crossover error rate
      • Enrollment, throughput, and acceptability
    • Credential Management
      • Password policies and passphrases
      • Password managers and vaulting
      • Just-in-time provisioning

  2. Access Control Models and Mechanisms

     3 topics
    • Access Control Models
      • Discretionary access control (DAC)
      • Mandatory access control (MAC)
      • Role-based and rule-based access control
      • Attribute-based and risk-based access control
    • Authorization Concepts
      • Access control lists and capability tables
      • Least privilege and separation of duties enforcement
      • Privileged access management
    • Accountability and Auditing
      • Logging access events
      • Session management and timeouts
      • Access review and recertification

  3. Identity Management Across Environments

     4 topics
    • Identity Lifecycle Management
      • Provisioning, modification, and deprovisioning
      • Identity proofing and registration
      • Account types: user, service, privileged
    • Single Sign-On and Federation
      • SSO benefits and risks
      • SAML, OAuth 2.0, and OpenID Connect
      • Federated identity and trust relationships
    • Directory and Authentication Services
      • LDAP and Active Directory
      • Kerberos tickets and realms
      • RADIUS, TACACS+, and Diameter
    • Identity as a Service and Cloud IAM
      • IDaaS models
      • Just-in-time access to cloud resources
      • Credential management for third parties

Certified Information Systems Security Professional (CISSP) Identity and Access Management (IAM) flashcards — 51 questions with answers

  1. What are the three primary categories of authentication factors?

    Type 1 - something you know (knowledge, e.g., password/PIN); Type 2 - something you have (possession, e.g., token/smart card); Type 3 - something you are (biometric, e.g., fingerprint).

  2. In authentication, what are the two additional factor categories beyond knowledge, possession, and biometric?

    Type 4 - somewhere you are (location, e.g., GPS/IP geolocation); and something you do (behavior, e.g., keystroke dynamics or signature pattern).

  3. What distinguishes multifactor authentication (MFA) from using two of the same factor type?

    True MFA combines factors from two or more DIFFERENT categories (e.g., password + token). Using two passwords, or two knowledge items, is single-factor (multi-step), not multifactor.

  4. What is the difference between identification and authentication?

    Identification is claiming an identity (e.g., entering a username); authentication is proving that claimed identity is genuine (e.g., providing a password or biometric).

  5. In biometrics, what are the False Rejection Rate (FRR) and False Acceptance Rate (FAR), and which error types are they?

    FRR (Type I error) - a legitimate user is wrongly rejected. FAR (Type II error) - an impostor is wrongly accepted. FAR is the more dangerous security error.

  6. What is the Crossover Error Rate (CER) in biometrics and why does it matter?

    CER (Equal Error Rate) is the point where FRR equals FAR, expressed as a percentage. A lower CER indicates a more accurate biometric system and is the standard metric for comparing systems.

  7. How does adjusting a biometric system's sensitivity affect FAR and FRR?

    Increasing sensitivity raises FRR (more false rejections) but lowers FAR; decreasing sensitivity lowers FRR but raises FAR. They trade off inversely.

  8. In biometric system processing, what are enrollment and throughput?

    Enrollment is the initial registration of a user's biometric to create a reference template. Throughput is the rate at which the system processes and authenticates users (acceptable target generally under ~6 seconds).

  9. What biometric methods are generally considered most accurate?

    Iris scans and retina scans are among the most accurate. Iris is preferred for being less invasive and more stable over time; retina scans can reveal health information, raising privacy concerns.

  10. What is the purpose of password salting?

    A salt is random data added to a password before hashing so identical passwords produce different hashes. It defeats precomputed rainbow table attacks and makes brute-forcing each hash unique.

  11. What is the difference between password complexity, length, and a passphrase?

    Complexity requires varied character sets (upper/lower/digits/symbols); length is the number of characters; a passphrase is a long sequence of words. Length generally contributes more to strength than complexity.

  12. What are cognitive passwords and their main weakness?

    Cognitive passwords are knowledge-based authentication using personal questions (e.g., mother's maiden name). Their weakness is that answers are often publicly discoverable or guessable via social engineering.

  13. What is the difference between a synchronous and an asynchronous (dynamic) token?

    A synchronous token generates one-time passwords based on time or an event counter synchronized with the server (e.g., TOTP). An asynchronous token uses challenge-response: the server issues a challenge the token must compute a response to.

  14. What is account provisioning and deprovisioning in the identity lifecycle?

    Provisioning is creating and granting accounts/access when a user joins or changes roles; deprovisioning is promptly disabling/removing access when a user leaves or no longer needs it, preventing orphaned accounts.

  15. What is the principle behind regular user access reviews (recertification)?

    Periodically verifying that each user's privileges still match their job needs, removing accumulated excess access. It counters privilege creep (authorization/aggregation creep).

  16. What is privilege creep (authorization creep)?

    The gradual accumulation of access rights beyond what a user needs, typically as they change roles without old permissions being revoked. It violates least privilege.

  17. Define the principle of least privilege.

    Subjects should be granted only the minimum access rights and permissions necessary to perform their job functions, and no more.

  18. What is the principle of need-to-know and how does it relate to least privilege?

    Need-to-know restricts access to specific data/resources required for a task. Least privilege is broader (rights and permissions); need-to-know focuses specifically on access to information.

  19. In Discretionary Access Control (DAC), who determines access and how is it implemented?

    The data owner has discretion to grant access to objects they own, typically implemented via Access Control Lists (ACLs). It is identity-based and flexible but harder to centrally control.

  20. What characterizes Mandatory Access Control (MAC)?

    Access is enforced by the system based on security labels (clearances for subjects, classifications for objects) defined by central policy. Users cannot alter labels; used in high-security/military environments. It is non-discretionary and lattice-based.

Show the other 31 Identity and Access Management (IAM) flashcards

  1. How does Role-Based Access Control (RBAC) assign permissions?

    Permissions are assigned to roles, and users are assigned to roles based on job function. Users inherit role permissions. It eases administration in environments with high turnover.

  2. What is Rule-Based Access Control?

    Access is governed by a set of global rules/conditions applied to all subjects (e.g., firewall ACLs allowing traffic from certain ports/times). The rules, not individual identity, determine access.

  3. What is Attribute-Based Access Control (ABAC)?

    Access decisions are based on evaluating attributes (or policies) of the subject, object, action, and environment (e.g., department, time, location, device). It enables fine-grained, context-aware, dynamic control.

  4. What is the difference between a capability table and an access control list (ACL)?

    A capability table is bound to a SUBJECT and lists the objects/rights that subject can access (a row of the access matrix). An ACL is bound to an OBJECT and lists which subjects can access it (a column of the matrix).

  5. What is an access control matrix?

    A table mapping subjects (rows) to objects (columns), with cells specifying the rights each subject has on each object. Rows form capability lists; columns form ACLs.

  6. What are the three core elements often summarized as AAA in access control?

    Authentication (verifying identity), Authorization (granting appropriate access), and Accounting/Accountability (tracking and logging actions). Some models add Identification as a preceding step.

  7. What is the difference between authorization and accountability?

    Authorization determines what an authenticated subject is permitted to do. Accountability holds subjects responsible for their actions by recording them (via auditing/logging), enabling tracing actions back to an identity.

  8. What is non-repudiation and how is it supported in IAM?

    Non-repudiation ensures a subject cannot deny having performed an action. It is supported by strong authentication, unique accounts (no shared accounts), audit logs, and digital signatures.

  9. What is the purpose of audit trails and logging in accountability?

    They record who did what, when, and where, enabling detection of misuse, reconstruction of events, investigation, and enforcement of non-repudiation. Logs must be protected from tampering.

  10. What is clipping level in the context of auditing?

    A predefined threshold of acceptable activity (e.g., number of failed logins) below which events are not flagged. Exceeding the clipping level triggers an alert or response.

  11. What is the difference between authentication and Single Sign-On (SSO)?

    Authentication verifies identity for a resource. SSO lets a user authenticate once and gain access to multiple independent systems without re-authenticating, using a shared session/token.

  12. What is a key advantage and a key disadvantage of Single Sign-On (SSO)?

    Advantage: improved user convenience and centralized authentication management. Disadvantage: a single point of failure/compromise - one set of stolen credentials can unlock all linked systems.

  13. What is federated identity management?

    An arrangement where multiple organizations (trust domains) share identity information so users authenticated in one domain can access resources in another, without separate credentials. It extends SSO across organizational boundaries.

  14. What is SAML and what is it used for?

    Security Assertion Markup Language - an XML-based open standard for exchanging authentication and authorization assertions between an Identity Provider (IdP) and a Service Provider (SP). It is widely used for web-based SSO and federation.

  15. In SAML, what are the roles of the Identity Provider (IdP), Service Provider (SP), and Principal?

    The Principal is the user. The IdP authenticates the user and issues assertions. The SP (relying party) consumes the assertion and provides the requested resource/service.

  16. What is OAuth 2.0 primarily designed for?

    OAuth 2.0 is an authorization framework that lets a third-party application obtain delegated, limited access to a user's resources via access tokens, without sharing the user's credentials. It handles authorization, not authentication.

  17. What is OpenID Connect (OIDC)?

    An authentication layer built on top of OAuth 2.0 that adds an ID token (JWT), enabling federated authentication/SSO. OAuth handles authorization; OIDC adds identity verification.

  18. How does Kerberos provide authentication, and what tickets does it use?

    Kerberos uses a trusted third-party Key Distribution Center (KDC) with symmetric-key cryptography. The Authentication Server issues a Ticket Granting Ticket (TGT); the Ticket Granting Service then issues service tickets for specific resources, enabling SSO.

  19. What are the main components of the Kerberos KDC?

    The Authentication Server (AS), which verifies users and issues the TGT, and the Ticket Granting Service (TGS), which issues service tickets. Together they form the KDC holding all secret keys.

  20. What is a primary weakness of Kerberos?

    The KDC is a single point of failure and a high-value target; if compromised, all keys are exposed. Kerberos also requires reasonably synchronized clocks (tickets are time-stamped) and is vulnerable to offline password guessing on TGTs.

  21. What is LDAP and what is it used for in IAM?

    Lightweight Directory Access Protocol - a protocol for querying and modifying directory services that store identity, account, and resource information in a hierarchical tree. It underpins centralized authentication directories like Active Directory.

  22. What is RADIUS and what authentication scenario does it serve?

    Remote Authentication Dial-In User Service - a centralized AAA protocol commonly used for network access (VPN, Wi-Fi, dial-up). It combines authentication and authorization and uses UDP, encrypting only the password.

  23. How does TACACS+ differ from RADIUS?

    TACACS+ uses TCP, encrypts the entire packet payload (not just the password), and separates Authentication, Authorization, and Accounting into independent processes. RADIUS uses UDP and combines authn/authz. TACACS+ is favored for device administration.

  24. What is Identity as a Service (IDaaS)?

    A cloud-based subscription model that delivers identity and access management functions (SSO, MFA, provisioning, directory, federation) as a service, offloading IAM infrastructure to a third-party provider.

  25. What is SCIM and what problem does it solve?

    System for Cross-domain Identity Management - an open standard (REST/JSON) for automating the exchange of user identity information between identity domains, especially provisioning and deprovisioning of accounts across cloud applications.

  26. What is Just-In-Time (JIT) provisioning in federated/cloud IAM?

    Automatically creating a user account at the service provider on the user's first login, using attributes from the identity provider's assertion, eliminating the need to pre-provision accounts.

  27. In a federated trust, what is the difference between transitive and non-transitive trust?

    Transitive trust extends: if A trusts B and B trusts C, then A trusts C. Non-transitive trust does not extend beyond the directly established relationship; A would not automatically trust C.

  28. What is the difference between a Type 1 and Type 2 error's security impact in access control terms?

    A Type II error (false acceptance) lets an unauthorized subject in - a security breach. A Type I error (false rejection) merely inconveniences a legitimate user. Security-wise, minimizing Type II is the priority.

  29. What is session management and why is it important in IAM?

    Controlling the lifecycle of an authenticated session, including timeouts, idle lockouts, re-authentication, and secure session token handling. It limits exposure from unattended or hijacked sessions, especially critical with SSO.

  30. What is a one-time password (OTP) and what are its two common generation methods?

    An OTP is a password valid for a single login/session. It is generated either time-based (TOTP, tied to synchronized clocks) or HMAC/event-based (HOTP, tied to an incrementing counter).

  31. What is the difference between a subject and an object in access control?

    A subject is the active entity requesting access (user, process, program). An object is the passive entity being accessed (file, database, device). Access controls mediate what subjects may do to objects.

Certified Information Systems Security Professional (CISSP) Identity and Access Management (IAM) FAQ

What is in the Certified Information Systems Security Professional (CISSP) Identity and Access Management (IAM) syllabus?

Certified Information Systems Security Professional (CISSP) Identity and Access Management (IAM) is split into 3 chapters: Identification and Authentication, Access Control Models and Mechanisms and Identity Management Across Environments. Together they contain 10 topics and 31 sub-topics.

How many chapters are in Certified Information Systems Security Professional (CISSP) Identity and Access Management (IAM)?

3 chapters, containing 10 topics and 31 sub-topics. The largest chapter is Identity Management Across Environments, with 4 topics.

Are there flashcards for Certified Information Systems Security Professional (CISSP) Identity and Access Management (IAM)?

Yes — a 51-card Identity and Access Management (IAM) deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.