Understand mfa factors, federation, identity lifecycle and test the resulting controls with reproducible evidence.
45 min 165 XPSkills: MFA factors, Federation, Identity lifecycle
Brief
Northwind Freight needs defensible evidence for identity and authentication, not a vocabulary quiz. Start with the system boundary and trace how a technical state changes the confidentiality, integrity or availability of the service. A passing document is not a passing running system.
You will examine mfa factors, federation, identity lifecycle, then make short incident decisions and author a testable specification. Keep desired state, observed state and evidence separate: an approved requirement tells you what should happen, while a dated observation tells you what actually happened.
Never convert missing evidence into a passing control result.
Identity, authentication and authorization
An account is a system representation of an identity; a group aggregates principals for policy. Authentication establishes who is presenting a credential, while authorization decides whether that principal may perform a particular action on a particular resource. Successful login is not evidence of permission to read every record.
MFA requires distinct factor categories: knowledge, possession and inherence. Two passwords remain one factor category, while a password plus a hardware-held cryptographic authenticator uses two. Enrollment, recovery and factor replacement must be controlled because a weak recovery path can bypass an otherwise strong login procedure.
Authentication controls need factor enrollment state, policy enforcement and actual challenge events. An auditor asks whether recovery and service accounts are covered rather than merely counting users who enrolled a second factor.
Identity, authentication and authorization requires both a declared boundary and independently testable observations.
Directories and federation
A directory service stores identities, groups and attributes; applications may consume those attributes for access decisions. A stale group membership can preserve excessive privilege even when authentication works perfectly. Local application accounts can remain active after a central identity is disabled, so discover them as part of scope reconciliation.
SAML carries signed assertions in federation flows, while OIDC supplies an identity layer over OAuth 2.0 with ID tokens. Validate issuer, intended audience, signature and validity periods; OAuth access tokens are for API authorization and are not automatically login assertions. Single sign-on reduces repeated authentication, but logout and account disablement do not instantly revoke every existing application session.
Federation assurance requires trust metadata, key-rotation handling and session-revocation tests. An auditor asks which relying applications were tested and whether an expired or wrong-audience assertion is rejected.
Directories and federation requires both a declared boundary and independently testable observations.
Joiner, mover and leaver
Joiner access should follow approved role assignments with a named owner and start date. A mover requires removal of obsolete rights, not just adding new group memberships. A leaver requires disabling primary access, terminating sessions where supported and removing application-specific credentials or delegations.
A unique human account makes activity attributable; shared privileged accounts obscure responsibility. Service identities need owners, narrowly scoped rights and credential rotation independent of employee departure. Periodic review compares effective rights with current job need and records removals as well as approvals.
Lifecycle controls require correlated personnel events and target-system action times. An auditor asks for elapsed termination time across the whole application population, with exceptions for systems that were unavailable or outside the normal directory integration.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: Login is not permission
Scenario sim+55 XP
Read the brief and answer both questions.
Incident brief
A user authenticates correctly but cannot read the payroll record. A manager calls the access denial failed identity proof. The account is genuine but lacks the required right.
Term bank, not all of these are right
authenticationauthorizationencryptionfederation
1.1What established the claimed identity? (one word)
1.2What decided the record access? (one word)
Task 2: Two prompts, one category
Scenario sim+55 XP
Read the brief and answer both questions.
Incident brief
The privileged login requests two passwords. The operator calls this two-factor authentication. The approved replacement uses one password and a hardware-held cryptographic authenticator.
Term bank, not all of these are right
possessionknowledgeinherencelocation
2.1Which factor category does the hardware authenticator demonstrate? (one word)
2.2Which factor category does the password demonstrate? (one word)
Task 3: Role change or departure
Scenario sim+55 XP
Read the brief and answer both questions.
Incident brief
A staff member transfers teams and keeps old groups while gaining new ones. Another staff member leaves entirely, but the owner calls both events onboarding.
Term bank, not all of these are right
moverleaverjoinerrecertification
3.1Which lifecycle event describes the transfer? (one word)
The control owner calls the current summary complete because every field has a label. Several labels confuse a technical mechanism with assurance, and missing observations have been treated as passing.
Use the fixture as the authoritative requirement. Replace the empty fields with typed, testable values and identify the evidence needed to substantiate the claim. Do not copy the owner's optimistic summary.
Approved requirement and measured facts
Privileged access needs two distinct MFA factor categories. Leavers must be disabled within 4 hours and sessions revoked. Preserve approval and target-system events, not directory state alone.
1
2
3
4
5
6
7
8
9
10
11
12
Checks
Mfa factor categories meets the incident requirement
Leaver disable hours meets the incident requirement
The owner says all six statements are acceptable because they use technical vocabulary. Judge the actual claim, not the confidence of its author.
Accept accurate limited mechanism statements; reject false equivalence, excessive privilege, absent evidence, or conclusions beyond the observation.
Verdicts are accept or reject. Every rejection needs one reason code from: wrong-mechanism | excess-privilege | missing-evidence | unsupported-claim.
Claims submitted for assurance
IT5-1 An account is a system representation of an identity; a group aggregates principals for policy.
IT5-2 Treat "authorization" as interchangeable with "authentication"; no mechanism check is needed.
IT5-3 Let every employee modify the protected service configuration without approval or review.
IT5-4 A directory service stores identities, groups and attributes; applications may consume those attributes for access decisions. This statement describes the mechanism only, not a complete audit conclusion.
IT5-5 Report a pass when the required observation is missing; no dated source is retained.
IT5-6 Claim that a documented mfa factors policy proves every in-scope asset complied throughout the year.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · IT Fundamentals
Logging and Time
Understand event correlation, clock integrity, retention and test the resulting controls with reproducible evidence.
