6.4. Identity Lifecycle Management
💡 First Principle: Every control has attack vectors. The strength of an IAM system is determined not by its strongest component but by its weakest. An organization with strong MFA but no account lockout policy, or with excellent session management but orphaned admin accounts, has exploitable gaps that a determined attacker will find. IAM security requires defense in depth across the entire identity lifecycle.
Understanding IAM attack patterns reveals where the controls are insufficient and what architectural changes would address the gaps. The exam tests recognition of attack patterns and selection of the correct mitigation — not theoretical knowledge of attack mechanics in isolation.
Why this matters: IAM attack scenarios are among the most scenario-heavy in the exam. "An attacker has obtained a list of valid usernames. Over three weeks, they attempt to login to each account using the 20 most common passwords without triggering lockout. What attack is this, and what two controls would detect or prevent it?" requires recognizing password spraying, knowing that lockout policies are evaded by staying below the threshold, and identifying behavioral analytics as the detection control.
