Identity and Access Management, Interview Questions.

Identity and Access Management ensures the right people and systems have the right access, to the right resources, at the right time. It covers identity lifecycle (joiner, mover, leaver), authentication, authorisation, privileged access, federation and auditing.

Authentication proves identity, authorisation decides permitted actions, accounting records what was done (audit). Together they are the AAA model.

Something you know (password), have (key, phone), are (biometrics). MFA uses two or more distinct types. Phishing-resistant options such as FIDO2 keys and passkeys are strongest.

Role-based access control grants permissions by role: simple and auditable but can lead to role explosion. Attribute-based control decides from attributes of user, resource and context (department, data label, time, device): flexible but harder to reason about. Many systems combine both.

Least privilege: minimum access needed. Separation of duties: split sensitive tasks across people so no one can complete a risky action alone (for example, requester and approver differ).

Single sign-on lets users authenticate once for many apps. Protocols: SAML (XML, enterprise web apps), OpenID Connect (identity layer on OAuth 2.0, modern apps), and Kerberos in Windows domains.

OAuth 2.0 is a framework for delegated authorisation (an app gets limited access to an API). OpenID Connect adds an ID token and user info, so it handles authentication. Using plain OAuth as login is a classic mistake.

The client redirects the user to the identity provider with a code challenge, the user authenticates, the provider returns a short-lived code, and the client exchanges it with the matching code verifier for tokens. PKCE stops an intercepted code from being usable, and it is the recommended flow for public clients.

A user authenticates to the KDC and receives a Ticket Granting Ticket. To use a service, the client presents the TGT and gets a service ticket, which the service validates without contacting the KDC. Tickets avoid sending passwords, but attacks like Kerberoasting and ticket forging target weak service account passwords and the krbtgt key.

System for Cross-domain Identity Management: a standard API to provision and deprovision users and groups across applications, so access is created and removed automatically from the HR or identity source of truth.

Joiner gets access based on role, mover has access changed (and old access removed, since creep is the usual failure), leaver is deprovisioned promptly. Automate from the HR system and run periodic access reviews.

Periodic reviews where managers or owners confirm each user still needs access. Make them risk-based, show context, and remove by default if not approved. Rubber-stamping is the main weakness.

Inventory and assign an owner, use unique accounts per workload, prefer managed or workload identities and short-lived credentials, store secrets in a vault with rotation, restrict interactive logon, monitor use and expire unused ones.

Policy that evaluates context (user risk, device compliance, location, application sensitivity) and then allows, requires MFA, restricts or blocks. It enables adaptive controls instead of blanket rules.

MFA fatigue (push bombing), adversary-in-the-middle phishing proxies that steal session tokens, SIM swap, and help-desk social engineering. Defences: number matching, phishing-resistant FIDO2, token binding and short sessions, device checks, and strict identity verification for resets.

Privileged Access Management controls powerful accounts: vaulting and rotation of credentials, just-in-time elevation with approval, session recording, removal of standing admin rights, separate admin accounts, break-glass procedures and monitoring. Tiering keeps domain admin credentials off ordinary workstations.

Tier 0 controls identity (domain controllers, identity admins), tier 1 servers and applications, tier 2 workstations. Admin accounts of a higher tier never log on to a lower tier, which stops credential theft on a workstation from reaching domain control. It is the core defence against lateral movement to domain admin.

Inventory both directories, establish trust or federation first for quick access, map roles and groups, clean stale accounts, converge on one IdP in phases, align MFA and policy, and monitor for risky cross-domain access. Do not trade security for speed by granting broad access to everyone.

Impossible travel, spray patterns, new MFA registrations, mailbox rule creation, privileged role grants, token anomalies, unusual OAuth app consent, Kerberos anomalies (RC4 requests, ticket volume), and DCSync-like replication requests from non-DCs. Feed identity logs to the SIEM with high priority.

Users hold no permanent elevated rights. They request time-limited access with justification and approval, which expires automatically. It shrinks the window in which a stolen credential has power.

SAML signature validation flaws (wrapping), weak certificate management and long-lived assertions are classic risks. OIDC risks include redirect URI mistakes, missing state or nonce validation and token handling. In both, validate signatures, audience, issuer and expiry, and rotate keys.

Disable the account and revoke sessions, review what was accessed since departure, find why deprovisioning failed (HR sync gap, local app accounts, shared credentials), and fix with automation and a periodic orphan-account report.

It violates tiering and exposes credentials. Reset the account, check the laptops for credential theft, hunt for use of the credential, then enforce logon restrictions and separate admin workstations.

Reduce friction with SSO, risk-based prompts and trusted devices, move to passkeys and number matching, and keep strict step-up for sensitive actions. Measure helpdesk load and failures.

Provide named, time-limited accounts through PAM with approval, MFA, session recording, least-privilege scope, and automatic expiry, then review the activity afterwards.