These foundational questions test your understanding of core identity and access management concepts. Every IAM/PAM professional should be able to answer these confidently. Questions map to concepts from all labs.
IF user is in "Executives" group
AND accessing "Financial Reports" app
AND device is NOT compliant (Intune)
AND location is NOT corporate IP
AND sign-in risk is Medium or higher
THEN: Block access
ELSE IF device is compliant
AND location is any
THEN: Allow with MFA every 4 hours
AWS IAM is one of the most commonly tested areas in cloud security interviews. These questions cover IAM fundamentals through advanced topics like cross-account access and Organizations.
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::SOURCE_ACCOUNT:root"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "SECRET123"
}
}
}
{
"Effect": "Deny",
"Action": "ec2:TerminateInstances",
"Resource": "*",
"Condition": {
"BoolIfExists": {
"aws:MultiFactorAuthPresent": "false"
}
}
}
Microsoft Entra ID (formerly Azure AD) is the enterprise identity platform of choice for many organizations. These questions cover identity management, SSO, conditional access, and governance.
GCP IAM has a unique resource hierarchy model. These questions test your understanding of Google Cloud's approach to identity and access management.
iam.disableServiceAccountKeyCreation - No SA keyscompute.vmExternalIpAccess - Control public IPsstorage.uniformBucketLevelAccess - Enforce uniform accessgcp.resourceLocations - Restrict regionscompute.requireOsLogin - Force OS Login for VMsPrivileged Access Management is critical for enterprise security. These questions cover PAM concepts and CyberArk-specific implementation details.
These scenario-based questions test your ability to apply IAM knowledge to real enterprise situations. Interviewers use these to evaluate problem-solving skills.
Your portfolio demonstrates practical skills to employers. Here's how to turn these labs into impressive portfolio projects.
For each lab completed, create structured documentation:
Based on: LAB 7, LAB 8, LAB 9
What to showcase:
Based on: LAB 10, LAB 11, LAB 12
What to showcase:
Based on: LAB 13
What to showcase:
Based on: LAB 4, LAB 5, LAB 8
What to showcase:
iam-portfolio/
README.md # Overview of all projects
azure-entra-implementation/
README.md
architecture/
diagrams/ # Architecture diagrams
conditional-access/
policies.json # CA policy exports
pim/
role-settings.md # PIM configurations
screenshots/ # Redacted screenshots
aws-multi-account/
README.md
organization/
structure.md
scps/
deny-regions.json
deny-root.json
protect-security.json
permission-sets/
developer-access.json
terraform/ # IaC examples
gcp-iam/
README.md
custom-roles/
workload-identity/
certifications/
credentials.md # Your certs
Having skills is one thing—demonstrating them effectively is another. Here's how to make your IAM expertise visible to employers.
Public repo with README, architecture diagrams, code samples, documentation
Write about labs completed, challenges solved, lessons learned
Projects section, certifications, skills endorsements
YouTube walkthroughs of implementations (sanitized)
Meetups, conferences, webinars on IAM topics
Share insights, engage with IAM community
AWS Multi-Account Architecture:
• Designed and implemented AWS Organizations structure with 5 OUs and 15 accounts
• Created 8 SCPs enforcing security guardrails across organization
• Configured IAM Identity Center with SAML federation reducing credential management by 80%
Azure AD / Entra ID Implementation:
• Implemented Conditional Access policies protecting 5,000 users across 50 applications
• Configured Privileged Identity Management reducing standing admin access by 95%
• Automated identity lifecycle with workflows processing 200+ monthly changes
PAM Implementation:
• Deployed CyberArk PAM solution managing 2,000+ privileged accounts
• Configured session recording achieving 100% coverage for privileged access
• Reduced password rotation from manual 90-day cycle to automated daily rotation
Skills (Labs) + Documentation (Portfolio) + Visibility (Showcase) + Credentials (Certs) = Career Success
The combination of hands-on skills from these labs, documented proof in your portfolio, public visibility through blogging/speaking, and industry certifications creates a compelling professional profile.
| Certification | Labs Alignment | Focus |
|---|---|---|
| AWS Certified Security - Specialty | LAB 10, 11, 12 | AWS IAM, Organizations, Security |
| Microsoft SC-300 | LAB 7, 8, 9 | Entra ID, Conditional Access, Governance |
| Google Cloud Security Engineer | LAB 13 | GCP IAM, Organization Policies |
| CyberArk Defender / Sentry | LAB 6 | PAM Administration |
| Okta Certified Administrator | LAB 5 | Okta SSO, Lifecycle Management |
| CISSP | All | Overall Security, IAM Domain |