Identity and Access Management Architecture Questions

Design and evaluate architectures that provide authentication and authorization across users, services, and systems in enterprise environments. Coverage includes the identity lifecycle and provisioning, directory services and identity federation, single sign on and federation protocols such as Security Assertion Markup Language and OpenID Connect, multi factor authentication and passwordless authentication, privileged access management, service account and machine identity handling, and onboarding and offboarding workflows. Candidates should be able to design token issuance and lifecycle, secret and key management, service to service authentication patterns, session and credential rotation, and scalable authorization strategies for distributed systems and microservices. Policy and control topics include role based access control, attribute based access control, resource based policies, permission boundaries, separation of duties, policy decision point and policy enforcement point placement, and modeling for least privilege and role assumption flows. Operational concerns include high availability, scalability, performance tradeoffs, observability and monitoring of identity services, audit logging, access review and attestation processes, access request and approval workflows, emergency or break glass access processes, and testing and validation to prevent privilege escalation. The description also covers integration patterns with enterprise identity providers and cloud account models, balancing security with user experience, and compliance and regulatory considerations.