CISSP Domain 5: Identity and Access Management (IAM)
Domain 5.0: Identity and Access Management (IAM) · 13% of the exam
The control plane of a modern organization: all 6 objectives (5.1–5.6), from controlling physical and logical access through identification and authentication strategy, federated identity with a third party, the six authorization models, the provisioning lifecycle, and the authentication protocols themselves: OAuth and OpenID Connect, SAML, Kerberos, RADIUS and TACACS+.
All study guides, current and every new one.
- Interactive online guide
- Downloadable PDF
- Lifetime updates
- 30-day money-back guarantee
Secure checkout via Stripe · no account needed · instant access
13% of your exam score
Domain 5.0 is worth 13% of the CISSP exam. Walk in having mastered it, not hoping it doesn't come up.
Every objective, nothing extra
Built line by line from the official ISC2 CISSP objectives 5.1–5.6: 26 in-depth topics with worked scenarios and exam tips, in a 97-page guide you'll actually finish.
60 exam-style questions
Every question comes with instant feedback and a full explanation, so a wrong answer teaches you as much as a right one.
The cert that changes what you're paid
CISSP is the management-track credential for security: five years of experience to hold it, eight domains wide, and the one most senior security job descriptions name by itself.
Serving, transitioning, or a military spouse?
CISSP appears in the DoD 8140 qualification matrix. See how it maps to work roles, which credentialing program your branch runs, and what it will and will not pay for. Read the DoD 8140 guide →
Read a real excerpt, free
This is the actual opening of Module 5.1, Controlling access to assets, not marketing copy. If you like how it teaches, the rest of the guide reads the same way.
Control physical and logical access to assets
The six asset categories the outline names, the subject-object model, and why physical and logical access control are converging into one decision.
Marta Kliment inherited Aurora's identity estate as an archaeology project: four directories, two of which nobody could explain; badge access managed by facilities on a system that had no connection to HR; 1,900 service accounts, 400 of which had passwords set before 2020; and an application entitlement model that consisted of the sentence “ask Marek, he knows who should have it.” Marek had retired.
Identity is the control plane of a modern organization. When it is incoherent, every other control inherits the incoherence.
The model
| Term | Definition | Examples |
|---|---|---|
| Subject | The active entity requesting access. | A user, a process acting on a user's behalf, a device, a service identity, an automated workload. |
| Object | The passive resource being accessed. | A file, a record, a database, a room, an API, a queue. |
| Access | The operation the subject performs on the object. | Read, write, execute, delete, enter, invoke. |
| Reference monitor | Whatever mediates the decision, per objective 3.2. | The kernel, the authorization service, the door controller. |
The same subject can be an object — a user account is an object when an administrator modifies it — which is why administrative access to the identity system is itself a first-class access control problem.
The six asset categories
| Category | What controlling access means | Characteristic failure |
|---|---|---|
| Information | Access decided by classification and need-to-know, enforced at the record or field level where the data warrants it. | Access granted at the database level when the requirement was one table, or at the table level when it was one customer's rows. |
| Systems | Who may log in to a host or platform, at what privilege, from where. | Standing administrative rights and shared local accounts. |
| Devices | Which devices may connect and hold data, with enrolment, posture and ownership recorded. | Unenrolled personal devices holding corporate data with no way to revoke it. |
| Facilities | Physical zones, badge entitlements, escorting, and time-of-day restrictions. | Badge access that survives termination because facilities never learns about leavers. |
| Applications | Entitlements within the application — which functions, which data, which approval limits. | A single “user” role that grants everything the application can do. |
| Services | Machine-to-machine authorization: which service may call which API, with what scope, using what credential. | A shared API key with full scope, embedded in five applications, that cannot be rotated. |
An access decision made at the interface — a hidden menu item, a disabled button, a filtered list — is not access control. The check must be made where the resource is served, on every request, against the authenticated identity. Stems describing a user reaching data by editing a request or calling an API directly are testing this, and the answer is always server-side enforcement at the resource.
Not ready to buy? Read it later.
We'll email you a free sample of this guide as a PDF, no purchase needed.
Try 3 sample questions
Pulled straight from the guide's 60-question bank. Tap an answer for instant feedback and the explanation.
From module 5.1 · Controlling access to assets
1. An application hides a menu item from users who lack an entitlement, but the underlying API accepts the request from any authenticated user. What principle has been violated?
From module 5.2 · Identification & authentication strategy
1. A system requires a password and a security question. How should this be classified?
From module 5.3 · Federated identity
1. In a federation, which party makes the authorization decision?
57 more questions like these are waiting inside.
What's inside
- 26 in-depth topics across 6 modules, mapped to objectives 5.1–5.6
- 60 exam-style practice questions with instant feedback
- Full answer key explaining why every distractor is wrong
- RBAC against ABAC, the pair most often confused
- Why OAuth is not authentication, and what to use instead
- Complete CISSP acronym & key-term reference
- 97-page downloadable PDF for offline study and printing
- Lifetime updates as the exam evolves
The modules, mapped to the objectives
- 5.110 Qs
Controlling access to assets
Control physical and logical access to assets
Subjects & objectsInformation, systems, devicesFacilities, applications, servicesPhysical and logical convergenceLeast privilege & need to knowEnforcement at the resource - 5.210 Qs
Identification & authentication strategy
Design identification and authentication strategy (e.g., people, devices, and services)
Identity proofing & registrationThe three authentication factorsFAR, FRR & crossover error rateMFA & passwordlessSession managementSSO, JIT & credential vaults - 5.310 Qs
Federated identity
Federated identity with a third-party service
Identity provider & relying partyAssertion trust & signingOn-premises, cloud & hybridIdentity as a ServiceAssertion lifetime & audienceRevocation across federation - 5.410 Qs
Authorization mechanisms
Implement and manage authorization mechanisms
DAC, MAC & RBACRule-based access controlABAC & attribute policyRisk-based & conditional accessPDP, PEP, PIP & PAPAccess control matrix & capability lists - 5.510 Qs
Provisioning lifecycle
Manage the identity and access provisioning lifecycle
Automated provisioning from HRDeprovisioning completenessAccess review & recertificationRole definition & transitionPrivilege escalation auditingService account management - 5.610 Qs
Authentication systems
Implement authentication systems
OAuth 2.0 vs. OpenID ConnectSAML assertions & flowsKerberos: KDC, TGT, service ticketsClock skew & replay protectionRADIUS vs. TACACS+Token validation
About the author
Chris Rees
Professional information technologist with 25+ years in IT and the author of 51 certification training courses, 50+ live on Pluralsight, rated 4.6/5 across more than 2,000 reviews. This guide is that same exam-focused teaching, in a format you can finish.
More about ChrisSitting the whole exam? Get the Complete CISSP Collection.
Every domain of the exam, including this guide, for $129, one time.
See everything insideQuestions, answered
Do I need an account to buy?
No. Checkout is a single Stripe form: email and card, about 30 seconds. We create your access from your checkout email automatically and sign you in the moment payment completes.
Is this up to date with the real CISSP exam?
Yes. The guide is mapped module-by-module to the official ISC2 CISSP objectives (5.1–5.6), and lifetime updates are included, so as the exam evolves your guide does too.
What exactly do I get?
Instant access to the interactive online guide with all 60 practice questions, plus a 97-page PDF you can download, print, and keep forever.
Do I need the other domains too?
This guide covers Domain 5.0 (13% of the exam). To prepare for the whole exam, the Complete CISSP Collection bundles all 8 domains for $129, less than the price of three guides.
What if it isn't for me?
Every purchase comes with a 30-day money-back guarantee. Email us and we'll refund you, no hoops.
Who wrote it?
Chris Rees, a professional information technologist with 25+ years in IT and the author of 51 certification courses published on Pluralsight, rated 4.6/5 across 2,007 ratings.
Be ready for 13% of the exam, for $24.95
Instant access, lifetime updates, and a 30-day money-back guarantee. The only risk is walking into the exam without it.
Get the guide