ISC2 CC IAM: Identity Lifecycle, Least Privilege, and Duties

What changes as an identity joins, changes roles, and leaves?

For ISC2 CC IAM scenarios, identify the lifecycle stage, then test whether the person's permissions fit the work and keep conflicting duties separate. ISC2's exam outline assigns Identity and Access Management (IAM) Concepts a 20% weight and includes role definition, provisioning, review, deprovisioning, least privilege, and separation of duties.

That is the outline effective September 1, 2026, checked November 3, 2026. Its weight indicates emphasis, not an exact number of IAM questions. The ISC2 CC domain guide places IAM alongside the other four domains; here the task is applying the concepts to a person's changing responsibilities.

Consider an original teaching example: Elena joins a small organization as an invoice preparer, later becomes a payment approver, then leaves. These are invented study cases, not recalled exam questions or a required business procedure.

The role change is the useful test. Adding approval rights while leaving every old right in place could let Elena prepare and approve the same payment. Her new role may be correct while her combined permissions are wrong.

Write the current role beside each permission before deciding which lifecycle action is needed. For broader study across the outline, full ISC2 CC prep planned for launch covers all five domains.

How do authentication and allowed actions differ?

Authentication helps verify an identity. Logical access controls determine whether that identity can use a resource or perform an action. NIST's An Introduction to Information Security separates these ideas and also explains accountability: connecting actions with the individual responsible.

Return to Elena's invoice role. Three separate checks make the distinctions concrete:

1. Identity: is the person signing in Elena? This is the authentication question.
2. Permission: may Elena enter an invoice, approve it, or only view it? This is the authorization question.
3. Responsibility: can the action be associated with the individual who performed it? This is the accountability question.

Successful authentication does not settle the second question. If Elena can approve payments despite having no approval duties, the scenario points to an access problem even if her identity was correctly verified. If the record cannot distinguish who performed an action, consider accountability separately from the breadth of permissions.

For each practice scenario, underline the action at issue. “Can sign in” and “can approve a payment” describe different decisions. If the question instead concerns the harm caused by exposing or changing data, use the security principles scenarios to distinguish confidentiality and integrity before choosing a control.

When does least privilege solve the problem?

Least privilege limits access to what is needed for assigned duties. NIST describes it in terms of granting only the accesses required to perform those duties. The key comparison is between the person's work and the permissions actually held.

Suppose Elena only enters invoices, but she can also change every employee's personnel record. Nothing in the invented role requires that second capability. Removing it addresses excessive access through least privilege.

Use this sequence when studying a permission problem:

• State the work the person must complete.
• List the resources and actions that work requires.
• Identify permissions with no stated business need.
• Retain necessary access and remove the excess in your proposed answer.

The goal is a justified set of permissions. Removing invoice-entry access from an invoice preparer would prevent the work this example assigns. Granting every permission to avoid future requests would ignore the same boundary in the opposite direction.

A role change can require both additions and removals. In Elena's move to payment approval, ask what she now needs and what she no longer needs. Do not treat provisioning as a one-time decision that answers every later access question.

Practice defining the distinction without looking at the terms. For a separate recall format, full ISC2 CC prep planned for launch includes 450 flashcards; that is the total for the prep, not an IAM-only count.

When is separation of duties the relevant control?

Separation of duties divides conflicting responsibilities so one individual cannot complete the sensitive combination alone. NIST explains its value in reducing abuse that could otherwise occur without collusion.

In the invoice example, the organization wants one person to prepare a payment and another to approve it. Both actions are legitimate work. The concern is that one person could prepare an improper payment and authorize it without another person's participation.

Compare the two diagnoses:

These controls can work together. Reviewing Elena's old permissions may reveal both unnecessary access and an incompatible combination. Name the defect the scenario actually describes, then explain how the proposed control addresses it.

Separating duties also does not mean abuse becomes impossible. NIST's distinction about collusion matters: two people cooperating to misuse their separate privileges are a different situation from one person acting alone. In your explanation, identify which single-person combination the control prevents.

How can you audit a simple permission scenario?

Use the following original study matrix after Elena becomes the approver and Marcus becomes the invoice preparer. Assume this example's policy requires different people to prepare and approve the same payment.

Read each row for least privilege: does that person's work justify each “Yes”? Then read across the sensitive actions: can the same person perform both preparation and approval? Finally, check whether access matches the current lifecycle stage, including departure.

Now change one cell at a time and explain the result. Give Elena invoice-entry rights again: that creates the conflicting combination in this example. Give Marcus personnel-editing rights: that creates excess access. Restore the former employee's access: that exposes a deprovisioning failure. This exercise makes you explain a specific defect rather than select an answer from a familiar keyword.

Try the 20 free ISC2 CC practice questions, then put the concepts you cannot explain into the free ISC2 CC study plan. A small practice set is a starting point for finding gaps, not a certification of readiness. For a larger practice pool, full ISC2 CC prep planned for launch includes 900 questions.

Your next step is to redraw the matrix from memory and narrate Elena's join/change/leave sequence. Once the distinctions are clear, return to the official outline for the remaining access-control-model objectives. If you are planning your exam purchase alongside study, the ISC2 CC exam cost guide covers that separate decision.