Overview
Domain 2 covers identity and access from end to end. It starts with authentication methods: single-factor and multi-factor authentication, single sign-on with technologies such as ADFS and OpenID Connect, device authentication by certificate, MAC address or TPM, and federated access with OAuth 2 and SAML. It covers internetwork trust architectures: one-way, two-way, transitive and zero trust relationships, the internet, intranet, extranet and DMZ, and third-party connections through APIs, extensions and middleware. It then covers the identity management life cycle, including proofing, provisioning, authorization, entitlement, monitoring and deprovisioning, and the access control models: mandatory, discretionary, role-based, rule-based and attribute-based.
The domain applies Domain 1's principles of least privilege, accountability and segregation of duties to identities. Its controls are monitored in Domain 3, investigated in Domain 4, protected with cryptography from Domain 5, and enforced at the network level in Domain 6.
How it's tested
Questions describe users, systems or partner connections and ask which authentication method, trust model or access control model is MOST appropriate, or what went wrong in the identity life cycle. Many are short classification questions. Others are scenarios about leavers, role changes or partner access.
-
Count the factors
Several authentication combinations are offered, and you must identify which is genuinely multi-factor because it uses different factor types.
-
Name the model
An access decision is described, such as labels, owner choice, job role, global rules or attributes, and you must identify the access control model.
-
Life cycle failure
A user changed roles or left, and you must identify the missed life cycle step or the resulting risk, such as privilege creep.
An employee moves from finance to marketing and, six months later, still has access to the payment system. Asked for the root cause, avoid blaming the payment system's controls. The identity life cycle failed: when the role changed, access was added for marketing but finance entitlements were never removed. That is privilege creep. Regular access reviews and role-change deprovisioning are the fixes.
Subdomains 4
Official subdomains from the ISC2 outline, in outline order.
2.1 Implement and maintain authentication methodsSingle and multi-factor authentication, SSO, device authentication and federated access.
- What it means
- Authentication verifies a claimed identity using factors: something you know, something you have, something you are, and sometimes somewhere you are or something you do. MFA combines different factor types. SSO lets one authentication grant access to many systems, for example through ADFS or OpenID Connect. Devices can authenticate with certificates, MAC addresses or TPM-backed keys. Federation lets organizations trust each other's identity assertions, using SAML or OAuth 2.
- What to understand
- MFA requires different factor types, so two passwords are still single-factor. SSO improves usability but concentrates risk on one credential, so it should be paired with MFA. MAC addresses are easily spoofed, which makes them weak device authentication. OAuth 2 delegates authorization, and OpenID Connect adds authentication on top of it.
- How it shows up
- Questions ask which combination is true MFA, which device authentication method is strongest, or which standard to use for partner SSO.
- Common confusion
- Counting two items of the same factor type, such as a password and a security question, as multi-factor.
2.2 Understand and support internetwork trust architecturesTrust relationships, network zones and third-party connections.
- What it means
- Trust relationships between domains or organizations can be one-way, two-way, transitive or zero trust. Networks are divided into the internet, intranet, extranet for partners, and the DMZ for public-facing services. Third-party connections through APIs, app extensions and middleware also create trust paths.
- What to understand
- Transitive trust means that if A trusts B and B trusts C, A may trust C, which can extend access unexpectedly. Zero trust removes implicit trust based on network location and verifies every request. A DMZ isolates public-facing systems from the internal network.
- How it shows up
- A scenario describes partner access or a new domain trust, and you must identify the risk, such as unintended transitive access, or the right zone for a system.
- Common confusion
- Assuming an extranet is the same as a DMZ. An extranet serves known partners, and a DMZ hosts services for the public.
2.3 Support and/or implement the identity management lifecycleProofing, provisioning, authorization, entitlement, monitoring and deprovisioning.
- What it means
- The identity life cycle covers identity proofing (verifying who someone is before issuing credentials), provisioning accounts and access, authorization and entitlements including inherited rights, ongoing monitoring, reporting and maintenance as roles and standards change, deprovisioning when access is no longer needed, and the IAM systems that automate it.
- What to understand
- Deprovisioning is where organizations most often fail, leaving orphaned accounts after people leave. Role changes cause privilege creep when old access is not removed. Periodic access reviews by managers or data owners catch both problems.
- How it shows up
- Questions describe leavers, movers or inherited permissions and ask for the risk or the BEST control.
- Common confusion
- Treating provisioning as the only security-critical step. Removal of access matters just as much.
2.4 Understand and administer access controlsMandatory, discretionary, role-based, rule-based and attribute-based access control.
- What it means
- In mandatory access control (MAC) the system enforces access based on labels and clearances. In discretionary access control (DAC) owners decide who can access their resources. Role-based access control (RBAC) grants permissions through job roles, and the outline includes privileged access management (PAM) here. Rule-based access control applies global rules, such as firewall rules or time-of-day limits. Attribute-based access control (ABAC) evaluates attributes of the user, resource, action and environment.
- What to understand
- MAC suits environments with formal classification, DAC suits flexible environments, and RBAC suits organizations with stable job functions. ABAC handles fine-grained, context-aware decisions. PAM adds extra control and monitoring for privileged accounts.
- How it shows up
- An access decision or environment is described, and you must identify the model or choose the most suitable one.
- Common confusion
- Mixing up role-based and rule-based. Role-based depends on who you are in the organization, and rule-based applies the same rules to everyone.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Authentication factors
Something you know, have or are, plus somewhere you are and something you do.
- Remember
- MFA needs at least two different factor types.
- Tested as
- Factor-counting questions.
- Trap
- Counting password plus PIN as MFA.
-
SSO
One authentication grants access to multiple systems.
- Remember
- It concentrates risk on one credential, so pair it with MFA.
- Tested as
- Authentication design questions.
- Trap
- Treating SSO as a security improvement on its own.
-
SAML vs. OAuth 2 vs. OpenID Connect
SAML exchanges authentication assertions. OAuth 2 delegates authorization. OpenID Connect adds authentication on top of OAuth 2.
- Remember
- OAuth 2 alone does not prove identity.
- Tested as
- Federation questions.
- Trap
- Using OAuth 2 for login without OpenID Connect.
-
Transitive trust
Trust that extends through a chain of trust relationships.
- Remember
- It can grant access to parties you never directly trusted.
- Tested as
- Trust architecture questions.
- Trap
- Assuming trust stops at the direct partner.
-
Zero trust
No implicit trust based on network location, so every request is verified.
- Remember
- It relies on strong identity, device posture and least privilege.
- Tested as
- Architecture questions.
- Trap
- Treating it as a single product.
-
Privilege creep
Accumulation of access as people change roles without old access being removed.
- Remember
- Periodic access reviews detect it.
- Tested as
- Life cycle questions.
- Trap
- Blaming the target system instead of the life cycle.
-
Identity proofing
Verifying a person's real identity before issuing credentials.
- Remember
- Weak proofing undermines every later control.
- Tested as
- Life cycle questions.
- Trap
- Skipping it for contractors or remote hires.
-
MAC vs. DAC
MAC is enforced by the system using labels. DAC lets owners grant access.
- Remember
- Users cannot override MAC decisions.
- Tested as
- Model identification.
- Trap
- Assuming MAC means MAC address.
-
RBAC vs. rule-based
RBAC grants access by job role. Rule-based applies global conditions to all users.
- Remember
- Firewall ACLs are a classic rule-based example.
- Tested as
- Model identification.
- Trap
- Confusing the two because both abbreviate to RBAC.
-
ABAC
Access decisions based on attributes of the user, resource, action and environment.
- Remember
- It supports fine-grained, context-aware policies such as location or time.
- Tested as
- Model selection.
- Trap
- Choosing RBAC when context like device or location must be considered.
-
PAM
Privileged access management controls, monitors and often vaults privileged credentials.
- Remember
- It applies extra controls such as just-in-time access and session recording.
- Tested as
- Privileged account questions.
- Trap
- Managing admin accounts like normal user accounts.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
MAC vs. DAC vs. RBAC vs. rule-based vs. ABAC
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Mandatory (MAC) | System enforces access using labels and clearances | Users cannot change permissions | Confusing it with MAC addresses |
| Discretionary (DAC) | Resource owners grant access | Flexible but prone to over-sharing | Using it where formal classification is required |
| Role-based (RBAC) | Permissions assigned to job roles | Depends on who you are in the organization | Role explosion when roles are too granular |
| Rule-based | Global rules applied to all subjects | Depends on conditions, not identity | Mistaking it for role-based |
| Attribute-based (ABAC) | Policies evaluate attributes of user, resource, action and environment | Most fine-grained and context-aware | Underestimating policy complexity |
One-way vs. two-way vs. transitive vs. zero trust
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| One-way trust | Domain A trusts domain B, but not the reverse | Access flows in one direction | Assuming it is mutual |
| Two-way trust | Both domains trust each other | Access can flow both ways | Granting it when one-way is enough |
| Transitive trust | Trust extends through chains of relationships | Can reach parties not directly trusted | Overlooking indirect access |
| Zero trust | No implicit trust; every request is verified | Removes location-based trust | Thinking it removes the need for identity controls |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Same-type factors
- What candidates pick
- A password plus a security question as MFA.
- Why it looks right
- There are two separate prompts.
- Why it's wrong
- Both are something you know, so it is still single-factor.
Clue to watch for Check the factor type of each element, not how many there are.
-
MAC address as strong authentication
- What candidates pick
- Authenticate devices to the network by MAC address filtering.
- Why it looks right
- Every device has a unique MAC address.
- Why it's wrong
- MAC addresses are easily spoofed. Certificates or TPM-backed credentials are much stronger.
Clue to watch for The question asks for the STRONGEST device authentication.
-
Role vs. rule
- What candidates pick
- Role-based access control for a firewall that blocks all traffic after 6 p.m.
- Why it looks right
- Both are abbreviated RBAC.
- Why it's wrong
- A condition applied to everyone regardless of role is rule-based.
Clue to watch for The access decision depends on a condition such as time or port, not job title.
-
Blame the target system
- What candidates pick
- Harden the payment system after a transferred employee keeps finance access.
- Why it looks right
- The payment system is where the exposure sits.
- Why it's wrong
- The cause is the identity life cycle failing to remove old entitlements at a role change.
Clue to watch for The user changed roles or left.
-
Trust stops at the partner
- What candidates pick
- Approve a transitive trust with a partner domain without further review.
- Why it looks right
- The partner itself is trusted.
- Why it's wrong
- Transitive trust may extend access to domains the partner trusts, which you never assessed.
Clue to watch for The scenario mentions the partner's own trust relationships or subsidiaries.
-
OAuth for login
- What candidates pick
- Use OAuth 2 alone to verify user identity for SSO.
- Why it looks right
- OAuth appears in many sign-in flows.
- Why it's wrong
- OAuth 2 grants delegated authorization. OpenID Connect or SAML is needed to authenticate users.
Clue to watch for The requirement is to prove who the user is.
Answer framework
For any Domain 2 scenario, work through these steps before choosing an answer.
- Decide whether the question is about authentication, which proves identity, or authorization, which decides what an authenticated identity may do.
- For authentication, count the distinct factor types and judge how easily each credential could be stolen, guessed or spoofed.
- For trust between networks or organizations, trace where access could flow, including indirect paths created by transitive relationships.
- For life cycle issues, locate the joiner, mover or leaver step that failed, and prefer periodic access reviews as the detective control.
- Match the environment to the access control model, choosing MAC, DAC, RBAC, rule-based or ABAC according to how decisions are actually made.
Practice question
Want more like this? The SSCP practice test has questions for every domain.
Checklist
0 of 11
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with authentication in 2.1. Learn the factor types until you can classify any credential instantly, then work through combinations to see which are truly multi-factor. Add SSO and federation, focusing on what SAML, OAuth 2 and OpenID Connect each do.
Next, study the access control models in 2.4. Build one example for each model and practice naming the model from a description. The role-based versus rule-based distinction is the most common trap, so drill it specifically.
Then cover the identity life cycle in 2.3, concentrating on movers and leavers. Candidates commonly underestimate how often the exam tests deprovisioning and privilege creep. Trust architectures in 2.2 are also underestimated, especially transitive trust and the difference between an extranet and a DMZ.
Afterwards, move to Domain 6, where the network access controls such as 802.1X, RADIUS and NAC enforce these identity decisions at the network level. Review every missed question by naming the exact distinction you got wrong.
FAQ
How much of the SSCP exam is Domain 2?
Access Controls carries 15% under the outline effective 1 October 2025.
Is a password plus a PIN multi-factor authentication?
No. Both are something you know. MFA requires at least two different factor types, such as a password and a hardware token.
What is the difference between role-based and rule-based access control?
Role-based access depends on a user's job role. Rule-based access applies the same conditions to everyone, such as firewall rules or time restrictions.
Why is deprovisioning emphasized?
Accounts left active after people leave or change roles are a common route to unauthorized access, so timely removal and regular access reviews are key controls.
Do I need to know federation protocols in detail?
You need to know what SAML, OAuth 2 and OpenID Connect are used for and the difference between authentication and authorization. Protocol message details are not the focus.
What is transitive trust?
Trust that extends through a chain, so if A trusts B and B trusts C, A may effectively trust C. It can extend access further than intended.
How does Domain 2 relate to Domain 6?
Domain 6 covers network access controls such as 802.1X, RADIUS, TACACS+ and NAC that enforce identity and access decisions at the network edge.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 2 knowledge
You have covered authentication, trust architectures, the identity life cycle and access control models. Test whether you can spot true MFA and name the right model under exam conditions.