CISSP Mastery
All domains
Domain 513% of exam

Identity and Access Management (IAM)

6 lessons ~3h

0%
0/6

Who can access what, and how that is proven and governed. Covers identification/authentication (incl. MFA and passwordless), the access-control models (RBAC, ABAC, MAC, DAC, rule/risk-based), federation and SSO, the provisioning lifecycle, and Zero Trust enforcement points.

Start studying Practice this domain

Exam tips — what to expect

  • 1Authorization models are the core of this domain. Learn the cue words: owner → DAC, labels/clearance → MAC, role/group → RBAC, attributes → ABAC, situation/risk → risk-based.
  • 2Know the three authentication factors and that MFA must combine DIFFERENT types. For biometrics, FAR (Type II error) is worse than FRR (Type I); CER is where they cross.
  • 3Kerberos specifics come up often: the KDC is the single point of failure, it issues TGTs/tickets, and clocks must stay within ~5 minutes (so NTP problems break logins).

Recommended reading

Official Study Guide (Sybex) 10eCh. 13–14Eleventh Hour CISSPDomain 5

Lessons

  1. 5.1

    Control physical and logical access to assets

    Access control applies uniformly to information, systems, devices, facilities, applications, and services.

    ~20 min

  2. 5.2

    Design identification and authentication strategy

    Know the three authentication factors, MFA and passwordless, the AAA model, SSO, JIT access, and identity proofing/registration. Covers people, devices, and services.

    ~40 min

  3. 5.3

    Federated identity with a third-party service

    Federation extends identity across trust boundaries. Know SAML, OAuth 2.0, and OIDC, and the on-prem / cloud / hybrid deployment models.

    ~25 min

  4. 5.4

    Implement and manage authorization mechanisms

    The most testable IAM lesson. Distinguish RBAC, rule-based, MAC (labels/clearances), DAC (owner-discretion), ABAC (attributes), and risk-based, plus PDP/PEP enforcement.

    ~45 min

  5. 5.5

    Manage the identity and access provisioning lifecycle

    Govern identities from joiner to leaver: provisioning/deprovisioning, access reviews, role transitions, service-account management, and controlling privilege escalation.

    ~30 min

  6. 5.6

    Implement authentication systems

    Know the protocols behind enterprise auth: Kerberos (tickets, KDC), RADIUS/TACACS+, OpenID Connect, and OAuth 2.0.

    ~30 min

Domain 5 Exam · 50 questions

Complete all 6 lessons above, then take the 50-question exam. Pass at 70% to unlock the next domain.

0/6 lessons done