Question 1

Define Identity and Access Management (IAM).

Accepted Answer

IAM is the discipline of managing digital identities and their access to resources. It covers authentication, authorisation, lifecycle, and audit.

Question 2

What are the three authentication factors?

Accepted Answer

Something you know (password, PIN), something you have (phone, hardware token), something you are (biometric). MFA requires evidence from at least two families.

Question 3

What is multi-factor authentication (MFA)?

Accepted Answer

Authentication using two or more factors from different categories: knowledge (password), possession (phone, key), inherence (biometric). Strong MFA significantly reduces account compromise.

Question 4

Name three phishing-resistant MFA methods.

Accepted Answer

FIDO2/WebAuthn hardware security keys (YubiKey), platform passkeys (Apple/Windows Hello), certificate-based authentication (smart cards). These cannot be tricked into completing on a fraudulent site.

Question 5

What is RBAC?

Accepted Answer

Role-Based Access Control. Permissions are grouped into roles, and users are assigned roles. Simple, predictable, and easy to audit.

Question 6

Explain RBAC vs ABAC.

Accepted Answer

RBAC grants permissions based on the user's role (simple, well-understood, but roles multiply). ABAC grants based on attributes of user, resource, action, environment (powerful, but harder to reason about).

Question 7

Compare SAML and OIDC.

Accepted Answer

SAML 2.0 — XML assertions, enterprise-friendly. OIDC — JSON / JWT-based, built on OAuth 2.0, modern web and mobile apps. Both are federation protocols; OIDC is preferred for new builds.

Question 8

What is SSO?

Accepted Answer

Single Sign-On — the user authenticates once and accesses multiple applications without re-entering credentials. Achieved technically via federation (SAML/OIDC) where apps trust tokens issued by a central IdP.

Question 9

What is the joiner-mover-leaver lifecycle?

Accepted Answer

A governance model that ties access changes to the employee lifecycle:Joiner — provision accounts and group memberships on day one.Mover — update memberships when the employee changes roles.Leaver — disable / delete accounts on the day of departure.

Question 10

What is federation?

Accepted Answer

A trust relationship between an IdP and an app. The IdP authenticates the user; the app accepts the IdP's signed token. SAML 2.0 and OIDC are the standards.

Question 11

What is SAML?

Accepted Answer

Security Assertion Markup Language — XML-based standard for browser SSO. Mature, well-supported by enterprise apps. Uses signed XML assertions over browser POST bindings.

Question 12

Explain attribute-based access control (ABAC).

Accepted Answer

ABAC evaluates access decisions against attributes of the user, resource, action, and environment. More flexible than RBAC but harder to reason about. Often implemented as policy-as-code using a policy engine like OPA or Cedar.

Question 13

What is OIDC?

Accepted Answer

OpenID Connect — modern identity standard built on OAuth 2.0. Uses JSON Web Tokens. API-friendly. Best for new apps, mobile, and machine-to-machine auth.

Question 14

Design an enterprise SSO architecture for 30 SaaS apps.

Accepted Answer

A typical design:Pick one IdP (Entra ID, Okta, Google Workspace) as the authoritative source.Federate to all 30 apps via SAML or OIDC.Group-based access: assign groups to apps, drive group membership from HR attributes via SCIM.Conditional Access / authentication policy: enforce MFA + managed device + trusted IP for sensitive apps.Just-in-time provisioning for apps that support it.Stream all IdP and app audit logs to a SIEM.Quarterly access reviews per app owner.

Question 15

What is the principle of least privilege?

Accepted Answer

Grant only the minimum permissions necessary to perform the task, for the shortest time needed. Implementation: RBAC with explicit roles, JIT elevation (PIM), short-lived credentials, regular access reviews.

Question 16

How would you respond to a suspected privilege-escalation incident?

Accepted Answer

Containment → investigation → eradication → recovery → lessons learned:Contain: disable the suspect account, revoke active sessions, force MFA re-registration.Investigate: pull IdP and target-app audit logs, correlate by user ID and session token.Eradicate: remove any backdoor accounts, rotate any credentials the suspect may have seen.Recover: restore any data the attacker modified; communicate to affected stakeholders.Lessons learned: document the attack chain, close the root cause, update runb

Question 17

What is the principle of least privilege and how do you enforce it?

Accepted Answer

Each user and service gets the minimum permissions needed to do the job. Enforce by:Start with zero access and add only what’s needed.Use just-in-time elevation for admin tasks (PAM tools, Entra ID PIM).Run quarterly access reviews to remove drift.Split admin accounts from daily-driver accounts; require step-up MFA for admin actions.

Question 18

What is zero trust?

Accepted Answer

A security model with no implicit trust based on network location. Every request is authenticated, authorised, and encrypted regardless of source. Identity + device posture + behaviour evaluated continuously.

Question 19

How do you prevent MFA fatigue attacks?

Accepted Answer

Configure MFA so the user must take an action that proves they are not on autopilot:Number matching: the push notification contains a 2-digit code the user must type in.FIDO2 / WebAuthn replaces push entirely.Conditional Access: only send push to trusted IPs / managed devices.Rate limiting on the IdP side: deny N failed push attempts in M minutes.

Question 20

What is JIT access?

Accepted Answer

Just-in-Time access — grants elevated permissions only when needed, for a bounded time, with approval. After the time bound expires, access is revoked. Eliminates standing privilege.

Question 21

What is the difference between authentication and authorisation?

Accepted Answer

Authentication verifies WHO the user is (login, MFA, tokens). Authorisation decides WHAT they can do (RBAC, scopes, claims). They are separate concerns — a user can be authenticated but not authorised for a specific resource.

Question 22

Explain the principle of least privilege.

Accepted Answer

Grant only the minimum permissions necessary to perform the task, for the shortest time needed. Implementation: RBAC with explicit roles, JIT elevation (PIM), short-lived credentials, regular access reviews.

Question 23

What is defence in depth?

Accepted Answer

Multiple overlapping security controls so a single failure does not lead to compromise. Examples: MFA + Conditional Access + Conditional Access for admins + PIM + SIEM monitoring. Each layer slows the attacker; together they make compromise infeasible.

Question 24

What is the difference between RBAC and ABAC?

Accepted Answer

RBAC (Role-Based Access Control) grants permissions based on the user's role. ABAC (Attribute-Based Access Control) grants based on attributes of user, resource, action, and environment. RBAC is simpler; ABAC is more expressive (e.g. "editors can edit documents created by their department").

Question 25

What is federated identity?

Accepted Answer

Federation lets users authenticate with one IdP and access resources in another system without a separate account. SAML and OIDC are the standards. Common pattern: workforce IdP (Okta/Entra ID) federates to SaaS apps.

Question 26

Explain SAML vs OIDC.

Accepted Answer

SAML 2.0 is XML-based, used for browser SSO since 2005. OIDC is JSON/JWT-based, built on OAuth 2.0, modern and API-friendly. Use SAML for legacy enterprise apps; OIDC for modern apps and APIs.

Question 27

What is Zero Trust?

Accepted Answer

A security model where no implicit trust is granted based on network location. Every request is authenticated, authorised, and encrypted regardless of source. Identity + device posture + behaviour are evaluated continuously.

Question 28

What is a session token vs an access token?

Accepted Answer

A session token (cookie or session ID) represents an authenticated browsing session and is tied to the browser. An access token (JWT, OAuth bearer) represents the right to call an API and is tied to a specific audience/scope. Use different tokens for different purposes.

Question 29

What is token rotation?

Accepted Answer

Periodically issuing new tokens and invalidating old ones. Refresh tokens with short lifetimes + rotation prevent long-lived stolen tokens from being useful. Refresh token reuse detection forces re-authentication.

Question 30

What is the difference between SSO and federation?

Accepted Answer

SSO (Single Sign-On) is the user experience — authenticate once, access multiple apps. Federation is the technical mechanism — apps trust tokens from a central IdP. SSO is achieved via federation in most enterprise contexts.