Domain 5 covers how organizations control who can access what: identification, authentication, authorization, access control models, and identity federation. At 13% weight, it's one of the larger domains, and it's also one of the more logically structured: most of the difficulty comes from precisely distinguishing similar-sounding access control models rather than raw technical complexity.
Identification vs. authentication vs. authorization
Identification is claiming an identity (a username). Authentication is proving it (a password, biometric, or token). Authorization is determining what the authenticated identity is allowed to do. All three are sequential and distinct.
Access control models
DAC (owner decides), MAC (labels/clearances, system-enforced), RBAC (role-based), ABAC (attribute-based, most flexible/dynamic), and Rule-BAC (if-then rules). Know which model fits which scenario: government/military contexts favor MAC, enterprise apps favor RBAC or ABAC.
Multi-factor authentication
Something you know, something you have, something you are: genuine MFA requires factors from at least two different categories. Two passwords is not MFA, no matter how complex either is.
Federation and SSO
SAML, OAuth 2.0, and OpenID Connect solve different problems: SAML is enterprise SSO/federation (XML-based assertions), OAuth 2.0 is authorization delegation (granting an app limited access without sharing a password), and OpenID Connect adds an authentication layer on top of OAuth 2.0.
Kerberos
Ticket-based authentication using a trusted third party (KDC), with a Ticket Granting Ticket (TGT) exchanged for service tickets. Know the core vulnerability points: golden ticket and silver ticket attacks.
OAuth 2.0 vs. OpenID Connect
OAuth 2.0 is about authorization ("can this app access my data"), not authentication ("who is this user"). OpenID Connect is the identity layer built on top of OAuth 2.0 that actually handles authentication; using OAuth alone to "log a user in" is a known anti-pattern the exam tests for.
RBAC vs. ABAC
RBAC grants permissions based on a static role assignment (simple, but can suffer role explosion). ABAC evaluates multiple dynamic attributes (user, resource, environment, action) at request time: more flexible, but more complex to implement and audit.
Practice D5 questions with instant feedback, free to start, no card required.
Start Free