Authentication factors, MFA, SSO, Zero Trust, PAM, access control models, and directory services. Weight: ~16% of exam.
Authentication proves you are who you claim to be. The exam categorizes auth into five factor types — know each category and its examples cold (National Institute of Standards and Technology [NIST], 2017; CompTIA, 2023).
MFA requires at least two factors from different categories (NIST, 2017). Password + PIN is NOT MFA (both are "something you know"). Password + OTP app is MFA. Behavioral factors such as typing cadence and signature dynamics represent an emerging category of continuous authentication (Stallings & Brown, 2018).
Single Sign-On (SSO) lets users authenticate once and access multiple systems without re-entering credentials (NIST, 2017). The key is understanding which protocol does what.
| Protocol | Purpose | Used For | Exam Clue |
|---|---|---|---|
| SAML 2.0 | Authentication + Authorization assertions (XML) | Enterprise SSO, cross-domain federation | "XML tokens" or "federated identity" |
| OAuth 2.0 | Authorization delegation (not authentication) | "Login with Google" — grants access without sharing password | "Delegate access" — NOT authentication by itself |
| OIDC | Identity layer on top of OAuth 2.0 | Authentication via JWT ID token | "OAuth + identity" — adds the who |
| Kerberos | Ticket-based auth in Active Directory | Internal Windows/AD environments | "TGT / TGS tickets" or "KDC" |
Federation: different organizations trust the same IdP. User logs in with Company A credentials to access Company B's app (OASIS, 2005). The OAuth 2.0 framework enables authorization delegation without credential sharing (Hardt, 2012), while OpenID Connect adds an identity layer using JSON Web Tokens (Jones et al., 2015). Kerberos provides ticket-based mutual authentication in Active Directory environments (Neuman et al., 2005).
Zero Trust rejects the concept of a trusted internal network. Every access request is authenticated, authorized, and continuously validated — regardless of source (Rose et al., 2020). Zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location (Rose et al., 2020).
| Traditional Perimeter | Zero Trust | |
|---|---|---|
| Trust model | Trust inside network | Trust no one by default |
| Lateral movement | Possible once inside | Blocked by microsegmentation |
| Auth frequency | One-time at login | Continuous re-validation |
| Remote work | VPN extends perimeter | Identity-based, device posture-aware |
PAM controls, monitors, and audits access for privileged accounts (admins, root, service accounts). These accounts are high-value targets — PAM reduces the attack surface around them (Joint Task Force, 2020; CyberArk, 2023). Just-in-time provisioning eliminates standing privileges by granting elevated rights only when needed and for a limited time (CompTIA, 2023).
| PAM Feature | What It Does | Why It Matters |
|---|---|---|
| Password Vaulting | Stores and rotates privileged credentials centrally | No one knows the actual password — vault grants access on demand |
| Just-in-Time (JIT) Access | Grants elevated rights only when needed, for a limited time | Eliminates standing privileges — access expires automatically |
| Session Recording | Records and logs every privileged session | Provides forensic audit trail; deters insider abuse |
| Multi-Factor Auth | Requires MFA for privileged account access | Stolen password alone cannot elevate access |
| Least Privilege Enforcement | Grants only the permissions required for the task | Limits blast radius if account is compromised |
Access control models define who decides what a subject can access. This is one of the highest-tested IAM topics — know every model's distinguishing characteristic (Stallings & Brown, 2018; CompTIA, 2023).
Directory services store and manage user identities and access policies. The exam expects you to match protocols to use cases and key ports (CompTIA, 2023; Stallings & Brown, 2018).