RANGER CompTIA Security+ (SY0-701) · chapter 19 of 27
Month 7: Who are you, and what may you touch?
In this chapter Objectives 4.6
Objective 4.6
Identity lifecycle and SSO
Provisioning, permissions, identity proofing
Provisioning/de-provisioning user accounts: create accounts with the right access on day one and disable them the moment someone leaves (a forgotten account is an open door). Permission assignments and implications: assign rights through groups and roles, not one by one; every extra permission widens the damage a stolen account can do, and rights pile up as people change jobs (privilege creep). Identity proofing verifies a person really is who they claim (ID documents, background checks, in-person check) before issuing credentials.
Exam tip Exam tip: "employee changed departments and still has old access" = privilege creep; fix with access reviews and role-based assignments.
Federation, SSO and interoperability
Federation is trust between identity systems of different organizations: users log in with their home identity provider and get into a partner's apps. Single sign-on (SSO) means one login unlocks many apps. Interoperability is how well identity systems and apps work together, which depends on shared standards.
LDAP, SAML and OAuth
Three standards make SSO and federation work across different systems:
- LDAP: protocol to query and update a directory (users, groups); TCP 389, or LDAPS on 636 with TLS.
- SAML: XML assertions from an identity provider (IdP) to a service provider (SP); classic enterprise web SSO.
- OAuth: an authorization framework; it gives an app a token to act on your behalf without your password. OpenID Connect adds login on top.
Exam tip Trap: OAuth is about authorization (what an app may access), not authentication. Login on top of OAuth = OpenID Connect.
Attestation
Attestation means proving a claim. In IAM it is used two ways: device attestation, where hardware (often a TPM) proves the device and its boot state are genuine and trusted before it gets access; and access attestation, where managers periodically confirm that each user's access is still correct (recertification). Both give evidence that access is deserved.
Objective 4.6
Access control models and authentication
Access control models
Who decides who gets in?
- Mandatory (MAC): the system enforces labels and clearances (Secret, Top Secret); users cannot change them.
- Discretionary (DAC): the owner of a file decides who can access it.
- Role-based (RBAC): rights come from job roles (Cashier, Warehouse Lead).
- Rule-based: admin-defined rules apply to everyone (allow VPN only from managed devices).
- Attribute-based (ABAC): decisions combine many attributes: user, resource, device, location, time.
- Time-of-day restrictions: access only in allowed hours. Least privilege: only the rights needed for the job.
Exam tip Memory trick: MAC = Military labels. DAC = Data owner decides. RBAC = Role. ABAC = All the attributes.
Multifactor authentication
MFA combines factors from different categories: something you know (password, PIN), something you have (phone, token, smart card), something you are (biometrics: fingerprint, face) and somewhere you are (location, network). Hard/soft authentication tokens: a hard token is a physical device showing codes; a soft token is an app on a phone. Security keys are hardware keys (USB/NFC, FIDO2) that prove possession with cryptography and resist phishing.
Exam tip Trap: a password plus a security question is two things you know, so it is NOT multifactor.
Password concepts
Password best practices as CompTIA lists them:
- Length: the strongest single factor; long passphrases beat short complex ones.
- Complexity: mixing character types. Reuse: block reuse of old passwords (password history).
- Expiration: forced change after a set time. Current NIST guidance says change only on evidence of compromise.
- Age: minimum password age stops users from cycling through changes to reuse an old favorite.
- Password managers generate and store unique passwords. Passwordless (passkeys, FIDO2, biometrics) removes the password entirely.
Exam tip NIST SP 800-63B: favor length, check new passwords against breached lists, and drop forced composition rules and scheduled resets.
Privileged access management (PAM)
Admin accounts are the crown jewels. PAM tools control them: just-in-time permissions grant admin rights only when needed for a set period, then remove them; password vaulting stores privileged credentials in a vault where admins check them out (logged and often rotated afterward); ephemeral credentials are short-lived credentials created for one session or task that expire on their own.
Exam tip Exam tip: "admin rights only during the change window, removed automatically" = just-in-time permissions.
Check yourself 1Kibble & Co.'s staff log in once to the company identity provider and then reach the cloud payroll app, which trusts XML assertions from that provider. Which standard is this?
- LDAP
- SAML
- OAuth
- RADIUS
Show the answer
Answer: B. SAML
SAML passes XML assertions from an identity provider to a service provider for web SSO.
Check yourself 2Which login uses two DIFFERENT authentication factors?
- Password and a security question
- Fingerprint scan followed by a face scan
- Password and an authenticator app code
- PIN and a passphrase
Show the answer
Answer: C. Password and an authenticator app code
A password is something you know; an authenticator app code proves something you have. Two different categories make it MFA.
Practice questions
Answer in your head, then open the answer. Ranger's Cyber Patrol has 60 questions like these for Security+, with mock exams.
Question 1A quarterly access review of the finance app produced the exhibit. Which TWO entries should be remediated? (Choose two.)
- m.lopez: can pay invoices and edit vendor bank details
- g.berg: contractor with view-only access and an end date
- svc-sync: read-only service account, no interactive logon
- r.shah: terminated, but the account is still enabled
- t.nguyen: an active clerk with a single role
Show the answer
Answers: A. m.lopez: can pay invoices and edit vendor bank details, D. r.shah: terminated, but the account is still enabled
r.shah left 41 days ago but the account is still enabled, a de-provisioning failure, and m.lopez can both change vendor bank details and process payments, a separation-of-duties conflict that enables fraud. The other entries follow least privilege.
Question 2An attacker's fake sign-in page relayed an employee's password and push approval to the real site in real time and captured the session. Kibble & Co. wants to stop this kind of attack for all staff. Which change is MOST effective?
- A longer minimum password length
- FIDO2 security keys bound to the real site
- Number matching on push notifications
- One-time codes sent by SMS
Show the answer
Answer: B. FIDO2 security keys bound to the real site
FIDO2/WebAuthn credentials are bound to the legitimate site's origin, so a look-alike proxy page cannot get a valid response from them. Number matching stops blind push approvals, but a real-time proxy can show the user the number to enter.
Question 3After a firewall outage, Kibble & Co. cannot tell who made the change: five engineers share the device's 'admin' account, and its password has not changed in two years. Which solution BEST restores accountability while still allowing emergency access?
- Require two engineers to sign in to 'admin' together
- Rotate the shared admin password every 30 days
- Named admin accounts; 'admin' vaulted in PAM with logged checkout
- Allow the shared 'admin' account to log in only from the device console
Show the answer
Answer: C. Named admin accounts; 'admin' vaulted in PAM with logged checkout
Named accounts tie each change to one person, and a PAM vault keeps the built-in account for break-glass use with every checkout logged. Rotating a password that is still shared does nothing about who used it.
Question 4A departed employee was disabled in Kibble & Co.'s identity provider on her last day. A week later, the marketing SaaS app shows the activity in the exhibit. The app has SAML SSO configured. What is the MOST likely gap?
- The app uses OAuth instead of SAML for sign-in
- An attacker forged a SAML assertion signed by the company's IdP
- Her IdP session token stayed valid for a week
- Local app passwords still work, so the IdP is bypassed
Show the answer
Answer: D. Local app passwords still work, so the IdP is bypassed
She signed in with a local app password, which never touches the IdP, so disabling her there had no effect. The fix is to enforce SSO-only sign-in and de-provision local accounts, ideally through automated provisioning.
CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.