4.3. Identity and Access Management
💡 First Principle: Identity management answers "who are you?" and access management answers "what are you allowed to do?" These are distinct problems. Perfect identity verification without access controls means authenticated users can do anything. Perfect access controls without identity verification can't enforce them. Both layers are required.
The exam heavily tests IAM because misconfigured access controls are the leading cause of security incidents. Understanding the difference between authentication (proving identity) and authorization (determining permissions) is fundamental.
⚠️ Common Misconception: MFA always means a password plus a code sent to your phone. The real requirement is two factors from different categories: something you know (password, PIN), something you have (smart card, hardware token, authenticator app), or something you are (biometric). Two passwords = still single-factor.
