Objective 4.6 looks like a vocabulary list. Provisioning and deprovisioning. Permission assignments. Identity proofing. Attestation. Then a pile of privileged access management tools at the end.
So people study it as terms to recognize. Then the exam hands you a scenario about somebody who moved departments, and the vocabulary does not help. Every option on the screen is a real control that a real company really uses.
Here is the shift that makes this domain easier: identity questions are rarely asking who should have access. They are asking how long somebody keeps access after the reason for it went away.
The middle of the lifecycle is where the questions live
The account lifecycle has three parts, and only one usually gets studied properly.
Provisioning is the beginning. Somebody proves who they are, an account gets created, permissions get assigned. Least privilege belongs here.
Deprovisioning is the end. Somebody leaves and the access goes away.
The middle is everything else, and the middle is where the exam sets its traps. People change roles. They cover for a coworker for two weeks. Somebody joins a project, gets added to a share, and the project ends. Nobody remembers.
Leaving triggers a process. Moving does not.
When an employee resigns, a process starts. HR knows. The manager knows. Somewhere a ticket gets filed that says disable this account. It gets filed because a departure is obviously an access event.
A transfer from finance over to marketing plays out differently. The person needs the marketing tools, so a ticket goes in to add that access. Nobody files the other ticket. Those old finance permissions just stay where they are, attached to a real person who still logs in every morning.
That accumulation has a name on the exam: permission creep, sometimes written as privilege creep. The stem describes it without ever naming it. Transferred six months ago, still approving invoices for the old department.
Read that kind of stem slowly, because the answer that feels obvious is usually the wrong one. Why?
Least privilege is not the fix for creep
There is a very good reason least privilege trips people up here. It sits right in the answer list and it feels correct.
Least privilege was what you were supposed to do at account creation, but that timing is exactly why it cannot be the cleanup. It describes what permissions should look like at the moment they get assigned. It does not go find the ones that already drifted.
What finds those is a review. Somebody with authority looks at who has access to what, then confirms each entry or strips it. CompTIA files this under attestation: a formal confirmation that access or identity information is still appropriate. Also called an access review, or a recertification.
So the split is this. Least privilege is a design rule applied when access is granted. Attestation is a recurring check on access that already exists. A stem describing a mess that piled up wants the second one.
The offboarding question has its own trap
Deprovisioning seems simple until the choices offer you both delete the account and disable the account. Which one?
Disable it. Deleting can take things with it that you still need: any route into that person's encrypted files and mailbox, plus the audit trail showing which account did what. Investigations tend to happen after somebody leaves. Fairly often they happen because somebody left.
Disabling kills the login immediately, which is the actual security requirement. Deletion happens later, once retention and legal sign off.
PAM asks the same question about administrators
The back half of 4.6 exists in order to solve one problem: standing privilege. An administrator holding admin rights all day is holding them during all the hours they are not doing anything administrative. Phish that account on a Tuesday afternoon and the attacker inherits everything it carries.
Three tools. Three different complaints.
Password vaulting stores privileged credentials centrally. Nobody memorizes the domain admin password anymore. You check it out, the vault records that you did, and the password rotates afterward. Reach for this when a stem complains about a shared admin password six people know, or when the logs cannot say which human was behind an action.
Ephemeral credentials have a short life built in. They expire on their own instead of waiting for somebody to remember to revoke them. Is the stem worried about credentials staying valid long after the work finished? That is the shape it is describing.
Just-in-time permissions go after standing privilege directly. The account carries no elevated rights during normal work. An admin task comes up, elevation gets requested and approved for a defined window, and then it drops off when the window closes.
A real PAM product does all three, so they blur on the job. On the exam they stay separable, but only because the stem tells you which complaint it is making.
The question to ask on any 4.6 scenario
How long does this person hold this permission, and what takes it away?
Provisioning decides what they get on day one. Attestation catches what they should have lost in the middle. Deprovisioning ends it. Elevation that expires shrinks the window to one task, and vaulting means they never personally hold the credential at all, which is the part people find genuinely strange the first time they watch a real rollout and realize the administrators themselves no longer know the password.
The fact that these work as exam questions comes down to the wrong answers. None are fake. You are being asked which real control fixes the failure in front of you, and that is a different skill from remembering definitions.
Want to know whether this domain is a weak spot for you? The free diagnostic at secplusmastery.com/diagnostic is scored by objective, so it will show you where 4.6 sits next to everything else. The full identity and access material, with scenario-style practice questions, lives at secplusmastery.com.
Top comments (0)