Missiora
Security+ Domain: Identity & Access Management

IT & Cyber Certifications

Security+ Domain: Identity & Access Management

3 min readPublished 22 Jul 2026

Track your progress. Sign in to mark this guide complete and build your Job Readiness Score.

On this page

Identity and Access Management (IAM) answers two questions: who are you? (authentication) and what are you allowed to do? (authorisation). Most breaches involve identity, which is why this domain is so heavily weighted and so relevant to real jobs.

Beginner: authentication factors

  • Something you know — password, PIN.
  • Something you have — token, phone, smart card.
  • Something you are — biometrics (fingerprint, face).

Multi-factor authentication (MFA) combines two or more different factor types, dramatically reducing account compromise even when a password is stolen.

Intermediate: access control models

Once a user is authenticated, an access-control model decides what they can do. Explore the four models Security+ expects you to know:

Interactive explainer

Access Control Models

The four ways systems decide what you are allowed to do.

1DAC2MAC3RBAC4ABAC

Tap or hover a part to learn more.

DAC

Discretionary.

The resource owner decides who gets access (e.g. file permissions you set yourself). Flexible but easy to misconfigure.

Check your understanding

1. Which model attaches permissions to roles that users inherit?

2. Which model uses labels and clearances enforced by the system?

Keep learning

Identity & Access ManagementSecure Architecture & Cloud CompTIA Security+
Practise this in AI Interview™

Layer these with least privilege (only the access needed) and separation of duties (no single person completes a sensitive action alone).

Advanced considerations

  • Single Sign-On (SSO) improves usability but concentrates risk — protect it with strong MFA.
  • Federation (SAML, OAuth 2.0, OpenID Connect) lets identities work across organisations.
  • Privileged Access Management (PAM) and just-in-time access protect the powerful accounts attackers want most.
  • Joiner/Mover/Leaver automation ensures access is granted, changed and revoked correctly across the employee lifecycle.

Practical example

A new starter is added to the 'Finance' role (RBAC), inheriting exactly the access that role needs — no more. MFA is enforced via an authenticator app. When they leave, disabling one account removes all access. Compare this to manually granting permissions per user, which quickly becomes unmanageable and insecure (permission creep).

Common mistakes

  • Conflating authentication with authorisation.
  • Permission creep — users accumulate access over time.
  • Shared accounts with no individual accountability.
  • MFA on user logins but not on admin/privileged access.

Best practices

Enforce MFA everywhere (especially privileged accounts), apply least privilege, review access regularly, automate joiner/mover/leaver processes, and protect privileged accounts with PAM. This underpins Zero Trust.

What employers expect

You can explain the difference between authentication and authorisation, recommend an appropriate access model, and justify MFA and least privilege in plain English.

Technical interview questions

  1. What is the difference between authentication and authorisation?
  2. Explain RBAC vs ABAC and when you would choose each.
  3. Why is MFA especially important on privileged accounts?
  4. What is SSO and what is its main risk?
  5. How would you handle the leaver part of the identity lifecycle?

Behavioural interview questions

  1. Tell me about a time you followed a strict process even under pressure.
  2. How would you handle a manager demanding admin rights they do not need?

Practice questions

  1. Which model attaches permissions to roles? (RBAC)
  2. A password plus an authenticator code is an example of? (MFA)
  3. Which principle gives users only the access they need? (Least privilege)
  4. Which model decides access from attributes like department and location? (ABAC)

Where this fits in your Security+ pathway

This domain is one part of the CompTIA Security+ study hub. When you're confident here, review Cryptography & PKI and move on to Secure Architecture & Cloud to keep building toward the full exam.

Practise with Missiora

Interview Intelligence

How this topic actually shows up in interviews — and how to demonstrate you understand it.

Why employers ask about this

IAM is where most breaches begin or are stopped; interviewers test least privilege and MFA because they're the highest-impact controls.

Technical questions
What is the difference between authentication and authorisation?+

Authentication proves who you are; authorisation decides what you're allowed to do once authenticated.

What is MFA and why does it matter?+

Multi-factor authentication requires two or more factors (something you know/have/are), drastically reducing the impact of stolen passwords.

Behavioural questions
Describe enforcing least privilege when a colleague wanted more access.+

Explain how you balanced their need against risk, and granted the minimum required with a review date.

Real-world scenarios
“A departing employee still has active accounts a week later.”+

Expected answer: Flag the offboarding gap; disable accounts promptly and recommend an automated joiner-mover-leaver process.

Common candidate mistakes
  • •Confusing authentication with authorisation.
  • •Granting broad access 'to be safe' instead of least privilege.
Common misconceptions

What candidates get wrong in interviews and on the job — and what strong professionals actually do.

Myth

Authentication and authorisation are the same thing.

Reality

Authentication proves who you are; authorisation decides what you're allowed to do.

In interviews: Mixing these up is one of the fastest ways to fail an IAM question.

On the job: Over-permissioned accounts appear because access is granted at logon rather than by role.

Best practice: Separate the two concepts and apply least privilege via roles/groups.

Why it matters: IAM mistakes are a leading cause of breaches — clarity here is a core professional skill.

Practise in AI Interview™Rehearse these questions, scored.Plan with Career Coach™A personalised path to your goal.Evidence it in Career Passport™Prove this skill to employers.

Employability Intelligence

Where this knowledge takes you — the jobs, skills and certifications it feeds into.

Relevant roles
IAM AnalystSecurity EngineerSOC Analyst
Skills you're proving
Authentication factorsLeast privilegeRBACSSO & MFA
Recommended certifications
CompTIA Security+
Career progression

IT Support → IAM Analyst → Security Engineer.

What employers expect

That you apply least privilege and can design sensible access controls.

Frequently asked questions

Is MFA the same as two-step verification?

Close, but true MFA uses factors of different types (know/have/are). Two codes of the same type are weaker than combining, say, a password with a hardware token.

Which access control model is most common at work?

Role-Based Access Control (RBAC) is the most widely used in business because it scales cleanly as people join, move and leave.

What is the difference between authentication and authorisation?

Authentication proves who you are (for example a password plus MFA), while authorisation decides what you are allowed to do once authenticated (for example your role's permissions). Security+ expects you to keep the two clearly distinct.

Related guides

CompTIA Security+ (SY0-701): Complete Free Study Guide & Career PathSecurity+ Domain: Cryptography & PKISecurity+ Domain: Secure Architecture & Cloud SecuritySecurity+ Domain: Threats, Attacks & Vulnerabilities

Practise what you've learned

Turn this guide into real, evidenced progress

Missiora helps you measure, improve and evidence the capabilities employers actually value — start with the tools best suited to this topic.

M
Published by
Missiora

Missiora is an AI Employability Intelligence platform. Our resources are researched and reviewed by the Missiora team to help you measure, improve and prove your career readiness.

All resources