Overview
Identity and Access Management (IAM) covers controlling physical and logical access to information, systems, devices, facilities, applications and services. Its six sub-objectives cover designing an identification and authentication strategy (groups and roles, MFA and password-less authentication, session management, identity proofing, federated identity management, credential management, single sign-on and just-in-time access), federation with third-party services, authorization mechanisms (RBAC, rule-based, MAC, DAC, ABAC and risk-based access control, with policy decision and enforcement points), the identity and access provisioning lifecycle, and authentication systems.
Candidates must separate identification, authentication, authorization and accountability, and choose the access model or federation protocol that fits a scenario. The domain applies Domain 3 cryptography (PKI, Kerberos, hashing) and Domain 4 protocols (802.1X, RADIUS), and its access reviews and logs are what Domain 6 tests and Domain 7 monitors.
How it's tested
Domain 5 questions describe an access problem and ask which model, factor, protocol or lifecycle step solves it. Expect scenarios about mergers needing federation, users accumulating rights after transfers, administrators needing temporary elevation, and authentication factors of different types. The clue is usually what decides access: the owner, a label, a role, attributes or risk signals.
-
Pick the access model
A description of who decides access and on what basis points to DAC, MAC, RBAC, rule-based, ABAC or risk-based control.
-
Pick the federation protocol
A requirement such as web SSO with a partner, delegated API access or modern login for a mobile app leads to SAML, OAuth 2.0 or OpenID Connect.
-
Fix the lifecycle
A transfer, termination, audit finding or service account issue requires the right provisioning, review or deprovisioning step.
A photo-printing website wants to retrieve a user's pictures from a cloud storage provider without ever seeing the user's storage password. OAuth 2.0 issues the printing site a scoped access token after the user consents. SAML is the strongest distractor, but it is designed for exchanging authentication assertions for web SSO, not delegated API authorization. OAuth 2.0 is the best answer.
Sub-objectives 6
Official sub-objectives from the ISC2 outline, in outline order.
5.1 Control physical and logical access to assetsAccess to information, systems, devices, facilities, applications and services.
- What it means
- Access control applies to every asset type: logical access to information, systems and applications, and physical access to devices and facilities. The same principles, least privilege, need to know and accountability, govern both.
- What to understand
- Physical and logical access should be integrated, for example disabling a badge and accounts together at termination. Every access decision needs identification, authentication, authorization and accountability through logging, the IAAA sequence.
- How it shows up
- A terminated employee's account was disabled but their badge still opened the data center, highlighting the need for integrated physical and logical deprovisioning.
- Common confusion
- Treating physical access as a facilities issue outside IAM; the outline places both under this objective.
5.2 Design identification and authentication strategy (e.g., people, devices, and services)Groups and roles, AAA, MFA, password-less, sessions, proofing, FIM, credential management, SSO and JIT.
- What it means
- This covers groups and roles; authentication, authorization and accounting (AAA) including multi-factor and password-less authentication; session management; registration, proofing and establishment of identity; federated identity management; credential management systems such as password vaults; single sign-on; and just-in-time access.
- What to understand
- MFA requires factors from different types: something you know, have, or are (plus location or behavior in some schemes); a password and a PIN are both 'know' factors. Biometric accuracy uses false rejection (Type I) and false acceptance (Type II) rates, with the crossover error rate (CER) comparing systems. Just-in-time access grants privilege only when needed and removes it automatically.
- How it shows up
- A scenario asks which combination is true multi-factor authentication, or which biometric metric to use when comparing two products (the CER).
- Common confusion
- Counting two passwords, or a password plus a security question, as MFA.
5.3 Federated identity with a third-party serviceOn-premise, cloud and hybrid federation.
- What it means
- Federation lets an identity provider (IdP) authenticate users for relying parties or service providers in other domains, on-premise, in the cloud or in hybrid arrangements. Common standards are SAML 2.0 for browser SSO, OAuth 2.0 for delegated authorization and OpenID Connect, an identity layer on OAuth 2.0.
- What to understand
- Trust is established between organizations, so the IdP's security becomes everyone's security; a compromised IdP compromises every federated service. SAML assertions are XML; OpenID Connect issues JSON Web Token ID tokens and suits mobile and modern web applications.
- How it shows up
- Two merged companies need employees to use each other's web applications without new accounts, pointing to SAML federation between the IdPs.
- Common confusion
- Calling OAuth an authentication protocol; OAuth 2.0 grants authorization, and OpenID Connect adds authentication on top.
5.4 Implement and manage authorization mechanismsRBAC, rule-based, MAC, DAC, ABAC, risk-based and policy enforcement points.
- What it means
- Authorization models decide what an authenticated subject may do. DAC lets the owner set permissions; MAC enforces system-assigned labels and clearances; RBAC grants permissions through job roles; rule-based access applies global rules such as firewall ACLs; ABAC evaluates attributes of subject, object, action and environment; risk-based control adjusts decisions by real-time risk signals.
- What to understand
- A policy decision point (PDP) evaluates requests against policy; a policy enforcement point (PEP) enforces the result in the request path. ABAC handles fine-grained context such as time, location and device posture that RBAC would need many roles to express.
- How it shows up
- A requirement such as 'contractors may read project files only from managed devices during business hours' calls for ABAC.
- Common confusion
- Confusing rule-based access control (global rules applied to all subjects) with role-based access control (permissions by job function).
5.5 Manage the identity and access provisioning lifecycleAccess reviews, provisioning and deprovisioning, roles, privilege escalation and service accounts.
- What it means
- The lifecycle covers account access reviews for user, system and service accounts; provisioning and deprovisioning during onboarding, transfers and offboarding; role definition and transition; managing privilege escalation (for example sudo, with auditing of its use); and service account management.
- What to understand
- Periodic access reviews, confirmed by managers or data owners, catch privilege creep and orphaned accounts. Service accounts often hold broad, non-expiring privileges, so they need owners, vaulted credentials, rotation and interactive-logon restrictions.
- How it shows up
- An audit finds a long-tenured employee with rights from three previous roles, and the fix is a recertification process plus removing old access at each transfer.
- Common confusion
- Treating access reviews as a security-team task alone; managers and data owners must attest that access is still needed.
5.6 Implement authentication systemsDeploying the systems that authenticate users and services.
- What it means
- This covers implementing authentication systems such as Kerberos, LDAP-based directories, RADIUS and TACACS+ for network and device administration, and federated or cloud identity platforms that support SSO and MFA.
- What to understand
- Kerberos uses a key distribution center (authentication service plus ticket-granting service) that issues time-limited tickets, so clock synchronization is required and the KDC is a single point of failure. RADIUS uses UDP and encrypts only the password in its packets, while TACACS+ uses TCP, encrypts the entire payload and separates authentication, authorization and accounting.
- How it shows up
- Administrators need per-command authorization and full encryption for device management logins, which points to TACACS+.
- Common confusion
- Assuming RADIUS encrypts the entire session; only the password field is protected.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
IAAA
Identification (claiming an identity), authentication (proving it), authorization (granting permissions) and accountability (tracing actions through logs).
- Remember
- A username is identification, not authentication.
- Tested as
- Sequencing and definition questions.
- Trap
- Calling a user ID an authentication factor.
-
Authentication factor types
Something you know (password, PIN), something you have (token, smart card, phone), something you are (biometric), with location and behavior sometimes added.
- Remember
- MFA needs factors from different types.
- Tested as
- Identifying genuine MFA.
- Trap
- Treating a password plus a PIN as two factors.
-
FRR, FAR and CER
False rejection rate (Type I) rejects valid users; false acceptance rate (Type II) accepts impostors; the crossover error rate is where they are equal.
- Remember
- Lower CER means a more accurate biometric system; FAR is the more dangerous error for security.
- Tested as
- Biometric comparison questions.
- Trap
- Choosing the system with the lowest FRR as most secure.
-
DAC vs. MAC
In DAC the owner decides who has access; in MAC the system enforces access by comparing labels with clearances, and users cannot change it.
- Remember
- MAC is typical of military and government systems; DAC is typical of commercial file systems.
- Tested as
- Model identification.
- Trap
- Labeling any strict control as MAC even when the owner sets permissions.
-
RBAC vs. rule-based
Role-based control assigns permissions to job roles; rule-based control applies global rules to all subjects, such as firewall rules or time-of-day restrictions.
- Remember
- RBAC reduces administrative effort when staff change jobs.
- Tested as
- Model identification with similar names.
- Trap
- Reading 'rule' and choosing role-based.
-
ABAC
Access decisions evaluate attributes of the subject, object, action and environment against policy.
- Remember
- It handles fine-grained, context-dependent rules and supports zero trust.
- Tested as
- Complex context requirements.
- Trap
- Choosing RBAC and creating role explosion instead.
-
PDP and PEP
The policy decision point evaluates the request; the policy enforcement point allows or blocks it in the access path.
- Remember
- Decision and enforcement are separated so policy can be centrally managed.
- Tested as
- Zero trust and ABAC architecture questions.
- Trap
- Swapping which component decides and which enforces.
-
SAML vs. OAuth 2.0 vs. OpenID Connect
SAML exchanges XML authentication assertions for web SSO; OAuth 2.0 delegates scoped authorization with access tokens; OpenID Connect adds authentication to OAuth with ID tokens.
- Remember
- OAuth alone is authorization, not authentication.
- Tested as
- Federation design questions.
- Trap
- Choosing OAuth for enterprise browser SSO with a partner IdP when SAML or OIDC is designed for authentication.
-
Kerberos
A ticket-based protocol where the KDC's authentication service issues a ticket-granting ticket, which the ticket-granting service exchanges for service tickets.
- Remember
- It needs synchronized clocks and makes the KDC a single point of failure and a high-value target.
- Tested as
- Authentication system and attack questions.
- Trap
- Believing Kerberos sends passwords across the network.
-
RADIUS vs. TACACS+
RADIUS uses UDP, combines authentication and authorization and encrypts only the password; TACACS+ uses TCP, separates AAA functions and encrypts the full payload.
- Remember
- TACACS+ suits device administration with per-command authorization.
- Tested as
- Remote and administrative access questions.
- Trap
- Assuming RADIUS provides full payload encryption.
-
Privilege creep
Gradual accumulation of permissions as users change roles without old access being removed.
- Remember
- Countered by deprovisioning on transfer and periodic access reviews.
- Tested as
- Lifecycle and audit scenarios.
- Trap
- Fixing one user's excess access without fixing the process.
-
Just-in-time access
Privileges granted only for an approved task and time window, then revoked automatically.
- Remember
- It reduces standing privilege that attackers can steal.
- Tested as
- Privileged access design questions.
- Trap
- Choosing permanent admin rights with extra monitoring instead.
-
Identity proofing
Verifying a person's claimed identity during registration, before credentials are issued.
- Remember
- Strong authentication is worthless if the wrong person was enrolled.
- Tested as
- Registration and help-desk reset scenarios.
- Trap
- Allowing password resets based on easily researched personal facts.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
DAC vs. MAC vs. RBAC vs. rule-based vs. ABAC
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| DAC | Owner grants access at their discretion | Flexible, but access spreads through owners' choices | Assuming owners always grant correctly |
| MAC | System enforces labels and clearances | Users cannot override | Confusing it with strict DAC |
| RBAC | Permissions attached to job roles | Simplifies administration through role changes | Role explosion when context is needed |
| Rule-based | Global rules apply to all subjects | Not tied to identity or role | Mixing it up with role-based because of the name |
| ABAC | Policy evaluates subject, object, action and environment attributes | Fine-grained and context-aware | Overlooking it when time, location or device matters |
SAML vs. OAuth 2.0 vs. OpenID Connect
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SAML 2.0 | XML assertions from an IdP to a service provider | Enterprise browser-based SSO and federation | Choosing it for delegated API access |
| OAuth 2.0 | Delegated authorization with scoped access tokens | Grants an app access to resources without sharing the password | Treating it as proof of identity |
| OpenID Connect | Identity layer on OAuth 2.0 using JWT ID tokens | Authentication for modern web and mobile apps | Thinking it replaces OAuth instead of extending it |
RADIUS vs. TACACS+
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| RADIUS | Network access AAA protocol | UDP; encrypts only the password; combines authentication and authorization | Assuming full payload encryption |
| TACACS+ | Device administration AAA protocol | TCP; encrypts the entire payload; separates AAA functions | Choosing RADIUS when per-command authorization is required |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Same-type MFA
- What candidates pick
- Password plus security question as two-factor authentication.
- Why it looks right
- Two separate prompts look like two factors.
- Why it's wrong
- Both are something you know, so it is single-factor authentication.
Clue to watch for Check the factor type of each element, not the number of steps.
-
Lowest FRR wins
- What candidates pick
- The biometric system with the fewest false rejections for a high-security area.
- Why it looks right
- Fewer user complaints.
- Why it's wrong
- For high security, false acceptance is the critical error; compare by CER or prioritize low FAR.
Clue to watch for The scenario emphasizes security over convenience.
-
OAuth for login
- What candidates pick
- OAuth 2.0 alone to authenticate users across organizations.
- Why it looks right
- Social logins seem to use OAuth.
- Why it's wrong
- OAuth issues authorization tokens; authentication requires OpenID Connect or SAML assertions.
Clue to watch for The requirement is to prove who the user is.
-
Role for every context
- What candidates pick
- Creating new RBAC roles for each combination of time, location and device.
- Why it looks right
- RBAC is familiar and widely deployed.
- Why it's wrong
- Context-dependent rules cause role explosion; ABAC evaluates attributes directly.
Clue to watch for Requirements mention time, location, device posture or data attributes.
-
Keep old access after transfer
- What candidates pick
- Adding new permissions on transfer while leaving old ones for a transition period without an end date.
- Why it looks right
- Avoids disrupting handover work.
- Why it's wrong
- This is how privilege creep happens; old access should be removed or time-bound and reviewed.
Clue to watch for An employee changed roles and still holds previous access.
-
Service accounts are exempt
- What candidates pick
- Excluding service accounts from access reviews because no person uses them.
- Why it looks right
- They are technical, not human.
- Why it's wrong
- The outline lists service account management and system and service account reviews; these accounts are prime attack targets.
Clue to watch for Non-human accounts with broad, non-expiring privileges.
Answer framework
Resolve Domain 5 scenarios by identifying which part of the identity chain has failed or needs designing.
- Separate the problem into identification, authentication, authorization or accountability, because each has different controls and failure modes.
- For authentication, confirm the factors are of different types and that identity proofing at registration, and at any help-desk reset, was strong enough to trust the result.
- For authorization, identify who decides and on what basis, then pick DAC, MAC, RBAC, rule-based, ABAC or risk-based control.
- For cross-organization access, choose federation by purpose: SAML or OpenID Connect for authentication, OAuth 2.0 for delegated authorization.
- Close the lifecycle: remove access on transfer and termination, review all user, system and service accounts periodically, and prefer just-in-time over standing privilege.
Practice question
Want more like this? The CISSP practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with the IAAA sequence and authentication factors (5.2), because every other topic builds on them. Then study authorization models (5.4) using a single table that shows who decides and on what basis for each model; most errors here come from similar names. Next cover federation (5.3) by purpose rather than by protocol detail, and finish with the lifecycle (5.5) and authentication systems (5.6), including Kerberos and RADIUS versus TACACS+.
High-priority concepts are MFA by factor type, the access models, SAML versus OAuth versus OpenID Connect, access reviews and Kerberos. Commonly underestimated areas are service account management, privilege escalation auditing and just-in-time access, which the 2024 outline names explicitly, and the physical side of access control in 5.1.
Practice by writing a short scenario for each access model and protocol, then swapping one detail to see how the answer changes. Afterwards, practice Domain 6 questions on access reviews and Domain 7 questions on privileged account management, since both test the lifecycle from a different angle.
FAQ
What is the difference between authentication and authorization?
Authentication proves a subject is who it claims to be. Authorization determines what that authenticated subject may access or do, based on an access control model and policy.
Which federation protocols should I know for the CISSP?
Know SAML 2.0 for enterprise browser SSO, OAuth 2.0 for delegated authorization and OpenID Connect for authentication built on OAuth. Focus on what each is for and the tokens or assertions it uses rather than message formats.
Is Kerberos still tested?
Yes. It remains the core authentication protocol in Windows domains and appears both here and in Domain 3 under Kerberos exploitation. Know the KDC, ticket-granting tickets, time synchronization and golden ticket risk.
What does just-in-time access mean?
Privileges are granted only when needed for a specific approved task and removed automatically afterwards. It reduces standing privileged accounts that attackers can compromise.
How do I tell rule-based from role-based access control?
Role-based control ties permissions to job functions assigned to users. Rule-based control applies the same rules to everyone regardless of role, such as a firewall rule or a time-of-day restriction.
Why do service accounts matter so much?
They often have broad privileges, non-expiring passwords and no human owner watching them. The 2024 outline lists service account management and service account reviews, so expect scenarios about vaulting, rotation and ownership.
How long should I study Domain 5?
Our editorial planning estimate is 30 to 35 hours within a 250-hour plan. Candidates who manage directories daily may need less, but should still drill the model and protocol distinctions.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- Azure Security Engineer Associate Same subject: Domain 1: Manage identity, access, and governance (20–25%)
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- CISM (Certified Information Security Manager) Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 5 knowledge
You have covered authentication strategy, federation, authorization models, the provisioning lifecycle and authentication systems. Check whether you can match the right model and protocol to each scenario.