Identity and Access Management Interview Questions for Cyber Security
24 Identity and Access Management questions with answers for cyber security roles — 4 easy, 15 medium, 5 hard.
About Identity and Access Management
Most breaches start with stolen credentials, so identity is now the main security perimeter. Learn MFA and passkeys, SSO with SAML and OIDC, OAuth, RBAC and ABAC, conditional access, privileged access management, joiner-mover-leaver processes, Active Directory attacks and defences, and access reviews that satisfy auditors.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
IAM is the set of processes and tools that manage digital identities and control their access to systems. It covers user provisioning and deprovisioning, authentication, authorisation, single sign-on, MFA, privileged access, access reviews and audit. Since most breaches involve stolen or misused credentials, IAM is a core security control. Common platforms include Microsoft Entra ID, Okta, Ping Identity and SailPoint for governance.
02
What is multi-factor authentication and which factors are strongest?
MFA requires two or more factor types: something you know like a password, something you have like a phone or security key, and something you are like a fingerprint. SMS OTPs are vulnerable to SIM swap and phishing, and push approvals to MFA fatigue. Phishing-resistant methods such as FIDO2 security keys, passkeys and certificate-based authentication are strongest because they are bound to the real site.
03
What is single sign-on and what protocols does it use?
SSO lets a user authenticate once with an identity provider and access many applications without separate passwords. SAML 2.0 uses signed XML assertions and is common for enterprise web apps. OpenID Connect, built on OAuth 2.0, uses JSON tokens and suits modern web and mobile apps. SSO reduces password reuse and helps central control, but makes the identity provider a high-value target that needs strong MFA.
04
A user's account shows sign-in risk high in your identity platform. What do you do?
Review the details: unfamiliar location, anonymous IP, leaked credentials or impossible travel. Check what happened after sign-in, such as MFA method registration, mailbox rules or data downloads. If compromise is likely, revoke sessions, reset the password, remove unknown MFA methods and contact the user out of band. Then confirm policies require MFA or block high-risk sign-ins automatically.
Passkeys are FIDO2 credentials that replace passwords. The device creates a key pair per website; the private key stays in the device or synced password manager, protected by biometrics or PIN, and the server stores only the public key. Login is a signature over a challenge tied to the real domain, so passkeys resist phishing and cannot be reused across sites. They also remove password reset load.
06
What is the difference between OAuth 2.0 and OpenID Connect?
OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.
Role-Based Access Control grants permissions to roles such as Finance Analyst, and users get roles; it is simple to manage and audit. Attribute-Based Access Control decides using attributes of the user, resource and context, such as department, data classification, location and time. ABAC is more flexible but harder to reason about. Many organisations use RBAC as the base and add attribute conditions for sensitive cases.
PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.
09
How would you design a joiner, mover, leaver process for a growing company?
JML is the identity lifecycle. Joiners get accounts and baseline access from HR data on day one. Movers change roles, and their old access must be removed, not just new access added, to avoid privilege creep. Leavers must be disabled promptly, ideally automatically when HR records their exit. Automating JML from the HR system to the identity platform reduces orphan accounts, which auditors frequently flag.
10
Describe a time you dealt with a user who was upset about losing access.
Situation: after an access review removed a sales manager's export rights, he escalated angrily before a client deadline. Task: solve his need while keeping the control. Action: I listened, explained why bulk exports were restricted, and arranged a time-bound approved export through his manager within an hour. Result: he met the deadline, and we added a documented request path for such cases.
Conditional access applies policies based on signals at sign-in, such as user, group, device compliance, location, application and risk score. For example, allow finance apps only from managed devices with MFA, block legacy authentication, and require a password change when sign-in risk is high. It is a key Zero Trust building block in platforms like Microsoft Entra ID. Policies need testing in report-only mode first.
12
Attackers bypassed MFA by sending repeated push notifications until a user approved. How do you prevent this?
This is MFA fatigue. Enable number matching and show app and location context in push requests, limit the number of prompts, and alert on repeated denials. Move high-risk users and admins to phishing-resistant methods such as FIDO2 keys or passkeys. Train users to report unexpected prompts. Also revoke the attacker's sessions and review what they accessed.
13
An audit finds 200 active accounts belonging to employees who left. How do you fix it?
Disable the accounts immediately after confirming with HR, then check each for recent logins, since any use after the exit date is a potential incident. Find the root cause, usually manual offboarding or apps not connected to SSO. Integrate the HR system with the identity platform for automatic disabling, connect apps to SSO and SCIM provisioning, and run monthly orphan account reports.
14
Developers share one admin account for a production database. What do you propose?
Shared accounts break accountability and are hard to rotate. Give each person an individual named account with least privilege, and provide admin access through PAM with just-in-time approval and session recording. Store the remaining break-glass credential in the vault with alerts on use. Use read-only roles for daily troubleshooting. Roll out with the team so it does not slow urgent fixes.
15
How do you find stale and privileged accounts in Active Directory with PowerShell?
A JWT has header, payload and signature separated by dots. Decode the first two parts to read claims, but never trust them without verifying the signature.
echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null
Check iss, aud, exp and nbf claims. In code, verify with a library using the expected algorithm and issuer keys, and reject alg none.
Start with admins and remote access, then high-risk groups like finance. Pick methods, preferring authenticator app number matching and passkeys or FIDO2 keys for admins. Pilot with one department, prepare helpdesk scripts and self-service registration, and communicate clearly with deadlines. Use conditional access in report-only mode to find gaps, then enforce. Block legacy authentication and track registration rates weekly.
18
How do you design an access review for a critical application?
Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.
19
Tell me about a time you had to say no to a senior person's access request.
Situation: a senior manager asked for permanent admin rights on production to speed up reports. Task: protect production without blocking the work. Action: I explained the audit and breach risk, then offered a read-only reporting role and a scheduled export within a day. Result: the manager got the data faster than before, and the audit later had no finding on that system.
Common attacks are password spraying, Kerberoasting, which requests service tickets for accounts with SPNs and cracks them offline, AS-REP roasting on accounts without pre-authentication, pass-the-hash, DCSync to pull password hashes, and abusing misconfigured ACLs and delegation. Defences include long random service account passwords or gMSAs, tiered admin models, LAPS for local admin passwords, Protected Users group and monitoring ticket requests.
21
An audit finds hundreds of service accounts with no owner and keys older than three years. What are the risks and which controls do you put in place?
Service accounts and API keys often have broad privileges, never expire, are shared among teams and are excluded from MFA. Machine identities now outnumber human ones in cloud environments. Risks include hardcoded secrets and silent abuse. Controls are an inventory with owners, least privilege, managed identities or workload identity federation instead of static keys, secret rotation, and monitoring for interactive logins.
22
Your company is acquiring another firm with its own Active Directory. How do you approach identity integration securely?
Start with assessment: their AD health, privileged accounts, trust relationships, MFA coverage and any signs of compromise. Avoid creating a full two-way forest trust early, as it can import their risks. Prefer bringing users into your cloud identity provider with B2B access or migration, with conditional access. Reset privileged credentials, apply your tiering model, and migrate application by application.
Create two cloud-only emergency accounts excluded from normal conditional access but protected by FIDO2 keys stored in a safe. Use long random passwords, store them split between two senior people or in a sealed vault, and give them the minimum emergency role. Alert the SOC on any sign-in, and test them every quarter. They exist for identity provider outages or misconfigured policies.
24
How would you implement just-in-time privileged access in the cloud?
Remove standing admin roles. Make users eligible for roles through a PIM or PAM tool, so they request activation with justification, MFA and optional approval, for a limited time like two hours. Log every activation and alert on unusual ones. For automation, use workload identities with narrow roles instead of admin keys. Review eligible assignments quarterly to keep the list small.
Frequently asked questions
How important is Identity and Access Management in Cyber Security interviews?
Most breaches start with stolen credentials, so identity is now the main security perimeter. Learn MFA and passkeys, SSO with SAML and OIDC, OAuth, RBAC and ABAC, conditional access, privileged access management, joiner-mover-leaver processes, Active Directory attacks and defences, and access reviews that satisfy auditors.
How should I use the Identity and Access Management sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.