CISSP Resources · Domain 5 — 13% of the exam
CISSP Domain 5 Guide: Identity and Access Management
Domain 5 is 13% of the exam and the domain where precise vocabulary pays off. Identification, authentication, authorisation and accountability are four different things, and the exam will test whether you can keep them apart.
What Domain 5 covers
- Identification, authentication, authorisation and accountability (IAAA)
- Authentication factors, MFA, and biometrics
- Access control models: DAC, MAC, RBAC, ABAC, rule-based
- Federation and single sign-on: SAML, OIDC, OAuth 2.0, Kerberos
- The identity lifecycle: provisioning, review, deprovisioning
- Privileged access management and credential management
The four factors and the four As
| Concept | Meaning | Example |
|---|---|---|
| Identification | Claiming an identity | Entering a username |
| Authentication | Proving the claim | Password plus token |
| Authorisation | What that identity may do | Access to a share |
| Accountability | Tying actions to the identity | Audit logs |
Multi-factor means factors of different types: something you know, something you have, something you are, and — depending on the source — somewhere you are and something you do. A password plus a security question is single factor twice.
Access control models
| Model | Who decides access | Typical use |
|---|---|---|
| DAC | The data owner, at their discretion | File system permissions |
| MAC | The system, based on labels and clearance | Military and classified environments |
| RBAC | Role assignment set centrally | Most enterprises |
| ABAC | Policy evaluating attributes at request time | Dynamic, context-aware access |
| Rule-based | Predefined rules applied to everyone | Firewall ACLs |
If the scenario mentions labels, clearances, or a system that will not let an owner share a file, the answer is MAC — not DAC, even though DAC feels more familiar.
Federation, SSO, and Kerberos
- SAML — XML assertions, common in enterprise web SSO.
- OAuth 2.0 — authorisation delegation, not authentication.
- OIDC — an authentication layer built on OAuth 2.0.
- Kerberos — ticket-based, uses symmetric cryptography and a KDC; requires synchronised clocks and makes the KDC a single point of failure.
SSO improves usability and reduces password fatigue, but it concentrates risk: one compromised credential can reach everything. Expect questions where the correct answer is to strengthen authentication on the SSO provider rather than abandon SSO.
Biometrics
- FRR (Type I) — a legitimate user rejected. Annoying.
- FAR (Type II) — an impostor accepted. Dangerous, and the one that matters for security.
- CER — where FRR and FAR meet; the lower the CER, the better the system.
- Tune towards a lower FAR when the asset is sensitive, and accept more false rejections as the cost.
Identity lifecycle and exam traps
- Deprovisioning is the most commonly failed control. Orphaned accounts appear constantly in exam scenarios.
- Access reviews are detective, not preventive.
- Privilege creep comes from transfers, not new hires — role changes must revoke as well as grant.
- Least privilege and need-to-know are related but distinct: least privilege limits actions, need-to-know limits data.
Study checklist
- Define identification, authentication, authorisation and accountability in one line each.
- Match each access control model to a scenario keyword.
- Explain what OAuth does and does not provide.
- Explain FAR, FRR and CER and which to tune for a high-security site.
Frequently asked questions
Is OAuth authentication or authorisation?
OAuth 2.0 is an authorisation framework. Authentication is provided by OpenID Connect, which is layered on top of it.
Which biometric error rate matters most for security?
The false acceptance rate (Type II), because it lets impostors in. High-security environments accept a higher false rejection rate to reduce it.
Nail the IAM vocabulary
Domain 5 questions on Domain Eight force the precise distinctions the exam uses as distractors — model, factor, protocol, and lifecycle stage.
Related guides
- Domain 6: Security Assessment and TestingAssessment strategies, testing techniques, audits, metrics and management review.
- Domain 7: Security OperationsInvestigations, incident response, monitoring, recovery and disaster recovery.
- Domain 8: Software Development SecuritySDLC models, secure coding, testing, third-party risk and database security.
- Data Owner vs Data ControllerWho classifies, who implements, who is legally accountable — the four roles the exam confuses on purpose.
More CISSP study material from Domain Eight: browse all resources.