EXAM-009 - Access, Identity, Authentication, and Rights

Topic Summary

The access-related controls form a chain: define access rules, manage identities, protect authentication secrets, and grant/review/remove actual access rights.

Key Concepts

• A.5.15: access control rules and principles.
• A.5.16: identity lifecycle.
• A.5.17: authentication information such as passwords, tokens, keys, and recovery secrets.
• A.5.18: access rights request, approval, provisioning, review, modification, and removal.

Common Exam Traps

• Treating user IDs as authentication secrets.
• Treating access reviews as only checking whether users still exist.
• Treating identity creation as the whole identity lifecycle.

Related Notes

• Access Control
• A.5.15 Access Control
• A.5.16 Identity Management
• A.5.17 Authentication Information
• A.5.18 Access Rights