CISSP Domain 5 study guide
What Identity and Access Management tests
Domain 5 governs who or what receives access, how identity is proven, what actions are authorized, and how privileges are reviewed and removed throughout the identity lifecycle.
Domain 5 objectives
Use these official objective areas as a coverage checklist, then combine them in scenario practice.
Control access to assets
Apply physical and logical access controls to information, systems, devices, and facilities.
Identification and authentication
Manage people, devices, and services using appropriate identity proofing and authentication factors.
Federated identity
Integrate third-party and cloud identity using federation, assertions, authorization delegation, and trust relationships.
Authorization mechanisms
Apply DAC, MAC, RBAC, rule-based, and attribute-based access according to policy.
Identity lifecycle
Provision, modify, review, recertify, and revoke access for joiners, movers, leavers, and service accounts.
Authentication systems
Implement and manage credential, session, passwordless, multifactor, and accountability controls.
High-yield distinctions
Identification
A subject claims an identity.
Authentication
The system verifies that identity claim.
Authorization
The system determines permitted actions.
Accountability
Actions can be traced to a subject.
SAML
Commonly carries authentication and authorization assertions for enterprise federation.
OAuth 2.0
Delegates limited authorization; it is not itself an authentication protocol.
Common exam trap
Separate authentication from authorization. Strong MFA does not correct excessive privilege, poor provisioning, or missing access reviews.
How to study Domain 5
Step 1: Master IAAA terminology.
Step 2: Compare authorization models.
Step 3: Learn the joiner–mover–leaver lifecycle.
Step 4: Distinguish SAML, OAuth, and OpenID Connect.
Step 5: Practice privileged-access and access-review scenarios.