Complete Guide Contents

155+
Interview Questions
13
Labs Covered
8
Portfolio Projects
6
Platforms Covered

Part 1: IAM Fundamentals Interview Questions

These foundational questions test your understanding of core identity and access management concepts. Every IAM/PAM professional should be able to answer these confidently. Questions map to concepts from all labs.

Authentication vs Authorization

Beginner
Q1: What is the difference between Authentication and Authorization?
Authentication (AuthN) verifies WHO you are - proving your identity through credentials (password, MFA, certificate, biometric).

Authorization (AuthZ) determines WHAT you can do - checking permissions after identity is verified.

Example: When you log into AWS Console, MFA + password authenticate you. Then IAM policies authorize which services you can access.
LAB 1, LAB 10
Beginner
Q2: Explain the principle of Least Privilege. Why is it important?
Least Privilege: Users and systems should have only the minimum permissions necessary to perform their job functions—nothing more.

Why it matters:
  • Limits blast radius if account is compromised
  • Reduces accidental damage from mistakes
  • Meets compliance requirements (SOC2, PCI-DSS, HIPAA)
  • Enables better audit trails
Implementation: Start with zero permissions, add only what's needed, review regularly.
All Labs
Beginner
Q3: What is Multi-Factor Authentication (MFA)? Name the three factors.
MFA requires two or more verification factors from different categories:

Three Factors:
  • Something you KNOW: Password, PIN, security questions
  • Something you HAVE: Phone (TOTP app), hardware token (YubiKey), smart card
  • Something you ARE: Fingerprint, facial recognition, retina scan
Best Practice: Combine factors from different categories (password + authenticator app).
LAB 2, LAB 5, LAB 8, LAB 10
Intermediate
Q4: What is RBAC vs ABAC? When would you use each?
RBAC (Role-Based Access Control):
  • Permissions assigned to roles, users assigned to roles
  • Simple: Developer role gets dev permissions
  • Best for: Static organizational structures
ABAC (Attribute-Based Access Control):
  • Permissions based on attributes (user, resource, environment)
  • Dynamic: User with department=Engineering AND location=US can access
  • Best for: Complex, dynamic environments
Real-world: Use RBAC for base permissions, ABAC for fine-grained context-aware access.
LAB 3, LAB 8, LAB 10
Intermediate
Q5: Explain the difference between SAML and OIDC/OAuth2. When would you use each?
SAML 2.0:
  • XML-based, older protocol (2005)
  • Designed for web browser SSO
  • Heavy, complex assertions
  • Best for: Enterprise SSO, legacy applications
OIDC (OpenID Connect) / OAuth2:
  • JSON-based, modern protocol
  • OAuth2 = Authorization, OIDC = Authentication layer on top
  • Lightweight, mobile-friendly
  • Best for: APIs, mobile apps, modern web apps
Decision:New applications OIDC. Enterprise with existing SAML infrastructure SAML.
LAB 4, LAB 5, LAB 8
Intermediate
Q6: What is Identity Federation? How does it work?
Federation: Trust relationship between identity providers allowing users to authenticate once and access multiple systems.

How it works:
  1. User authenticates with their Identity Provider (IdP)
  2. IdP issues a token/assertion (SAML assertion or OIDC token)
  3. User presents token to Service Provider (SP)
  4. SP validates token and grants access based on claims
Examples:
  • Okta AWS (SAML federation)
  • Azure AD SaaS apps
  • GitHub GCP (Workload Identity Federation)
LAB 4, LAB 5, LAB 10, LAB 12, LAB 13
Advanced
Q7: Explain the Identity Lifecycle (Joiner-Mover-Leaver). What happens at each stage?
JOINER (New Hire):
  • Create identity in IdP (synced from HR system)
  • Provision baseline access based on role/department
  • Generate temporary credentials (TAP)
  • Send welcome email with onboarding instructions
MOVER (Role Change):
  • Detect attribute change (department, manager, title)
  • Trigger access review for old permissions
  • Add new role-based access
  • Remove access no longer needed
LEAVER (Termination):
  • Immediately disable account (not delete)
  • Revoke all active sessions and tokens
  • Remove from all groups and access packages
  • Transfer data ownership, archive mailbox
  • Delete after retention period
LAB 7, LAB 9
Beginner
Q8: What is Single Sign-On (SSO)? What are its benefits?
SSO: User authenticates once and gains access to multiple applications without re-entering credentials.

Benefits:
  • User Experience: One login for all apps
  • Security: Fewer passwords = fewer phishing targets
  • IT Efficiency: Centralized access management
  • Compliance: Better audit trails, easier deprovisioning
  • Reduced Help Desk: Fewer password reset tickets
LAB 5, LAB 8, LAB 12
Intermediate
Q9: What is Zero Trust? How does it differ from traditional security?
Traditional (Perimeter-Based):
  • "Trust but verify" - trust users inside the network
  • Castle-and-moat approach
  • Once inside, relatively free movement
Zero Trust:
  • "Never trust, always verify" - no implicit trust
  • Verify every request regardless of location
  • Assume breach, minimize blast radius
  • Continuous validation, not one-time authentication
Zero Trust Pillars: Identity, Devices, Networks, Applications, Data
LAB 3, LAB 8
Advanced
Q10: What is Conditional Access? Describe a complex policy you've implemented.
Conditional Access: Context-aware access control that evaluates signals to make access decisions.

Signals evaluated: User, Device, Location, Application, Risk level, Time

Example Complex Policy:
IF user is in "Executives" group
AND accessing "Financial Reports" app
AND device is NOT compliant (Intune)
AND location is NOT corporate IP
AND sign-in risk is Medium or higher
THEN: Block access

ELSE IF device is compliant
AND location is any
THEN: Allow with MFA every 4 hours
LAB 8

More Fundamentals Questions

Beginner
Q11: What is the difference between a User and a Service Account?
User Account: Represents a human, has password/MFA, interactive login, should be unique per person.

Service Account: Represents an application/service, typically no interactive login, uses keys/tokens/certificates, should follow least privilege strictly.
LAB 10, LAB 13
Intermediate
Q12: What is Privileged Access Management (PAM)? What are its core components?
PAM: Security discipline focused on controlling and monitoring access to critical systems and sensitive data.

Core Components:
  • Credential Vault: Secure storage for privileged credentials
  • Session Management: Recording and monitoring privileged sessions
  • Access Control: Just-in-Time (JIT) access, approval workflows
  • Credential Rotation: Automatic password changes
  • Audit & Reporting: Who accessed what, when, why
LAB 6, LAB 8 (PIM)
Intermediate
Q13: What is Just-in-Time (JIT) Access? How does it improve security?
JIT Access: Privileged access granted only when needed, for a limited time, with appropriate approval.

Benefits:
  • Reduces standing privileges (less attack surface)
  • Creates audit trail for every elevation
  • Enforces accountability through approvals
  • Automatic expiration prevents privilege creep
Example: Azure PIM - user requests Global Admin for 4 hours, manager approves, access auto-expires.
LAB 6, LAB 8
Advanced
Q14: How would you design an access review process for a 10,000-user organization?
Design Approach:
  1. Categorize by risk: Privileged access (monthly), sensitive apps (quarterly), standard access (semi-annually)
  2. Assign reviewers: Managers review direct reports, app owners review app access
  3. Automate reminders: Email + Teams notifications at 7, 3, 1 days before deadline
  4. Decision helpers: Show last sign-in date, usage analytics
  5. Default action: Remove access if no response within 14 days
  6. Escalation: Notify security if review not completed
  7. Auto-apply: System removes access immediately upon denial
  8. Attestation: Reviewers must provide justification
LAB 9
Beginner
Q15: What is the difference between Authentication and Identity Proofing?
Identity Proofing: Initial verification that a person is who they claim to be (done once during onboarding). Examples: ID verification, background check, in-person verification.

Authentication: Ongoing verification each time user accesses a system (done repeatedly). Examples: Password, MFA, biometric.

Part 2: AWS IAM & Security Interview Questions

AWS IAM is one of the most commonly tested areas in cloud security interviews. These questions cover IAM fundamentals through advanced topics like cross-account access and Organizations.

Core AWS IAM Concepts

Beginner
Q16: What are the main components of AWS IAM?
Users: Individual identities for people or applications
Groups: Collections of users for easier permission management
Roles: Assumable identities with temporary credentials
Policies: JSON documents defining permissions
Identity Providers: External IdP integration (SAML, OIDC)
LAB 10
Intermediate
Q17: Explain the difference between IAM Users and IAM Roles. When should you use each?
IAM Users:
  • Long-term credentials (password, access keys)
  • One user = one identity (human or service)
  • Use for: Human console access (with MFA), legacy applications
IAM Roles:
  • Temporary credentials (STS tokens, 1-12 hours)
  • Assumable by users, services, or external entities
  • Use for: EC2/Lambda, cross-account access, federated users, CI/CD
Best Practice: Prefer roles over users wherever possible.
LAB 10
Intermediate
Q18: Describe the IAM policy evaluation logic. What happens when there are conflicting policies?
Evaluation Order:
  1. Start with implicit DENY (default)
  2. Check all applicable policies (identity, resource, SCPs, boundaries)
  3. Any explicit DENY DENY (wins over everything)
  4. Any explicit ALLOW ALLOW (if no deny)
  5. No explicit statement implicit DENY
Key Rule: Explicit DENY always wins.

Effective Permissions = Identity policies ∩ Permission boundary ∩ SCPs ∩ Resource policies
LAB 10
Advanced
Q19: What is a Permission Boundary? How does it differ from SCPs?
Permission Boundary:
  • Sets MAXIMUM permissions for an IAM entity (user/role)
  • Attached to individual users or roles
  • Use for: Delegated administration ("devs can create roles, but limited")
Service Control Policy (SCP):
  • Sets MAXIMUM permissions for entire accounts/OUs
  • Attached to Organization units or accounts
  • Does NOT affect management account
  • Use for: Organization-wide guardrails
Key Difference: Boundaries = entity level, SCPs = account level.
LAB 10, LAB 11
Advanced
Q20: How do you implement cross-account access in AWS? Explain the trust policy.
Cross-Account Pattern:
  1. Target Account: Create role with trust policy allowing source account
  2. Source Account: Grant sts:AssumeRole to users/roles
  3. User: Calls AssumeRole, gets temporary credentials
Trust Policy Example:
{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::SOURCE_ACCOUNT:root"
  },
  "Action": "sts:AssumeRole",
  "Condition": {
    "StringEquals": {
      "sts:ExternalId": "SECRET123"
    }
  }
}
ExternalId: Prevents confused deputy attacks.
LAB 10
Intermediate
Q21: What is the AWS root account? How should it be secured?
Root Account: The account created with the AWS account, has unrestricted access.

Security Requirements:
  • Enable MFA (hardware key preferred)
  • Delete all access keys
  • Use strong, unique password
  • Never use for daily operations
  • Store credentials in secure vault
  • Enable CloudTrail to monitor root activity
  • Create alerts for any root login
Root-Only Tasks: Account closure, changing account settings, enabling MFA delete on S3.
LAB 10
Advanced
Q22: Explain AWS Organizations and Control Tower. When would you use each?
AWS Organizations:
  • Centralized management of multiple AWS accounts
  • Consolidated billing
  • SCPs for governance
  • Free service
  • Use for: Any multi-account setup
Control Tower:
  • Automated landing zone setup ON TOP of Organizations
  • Pre-configured guardrails (preventive + detective)
  • Account Factory for automated provisioning
  • Dashboard for compliance monitoring
  • Use for: Enterprises wanting best-practice governance out-of-box
LAB 11
Intermediate
Q23: What is IAM Identity Center (SSO)? How is it different from IAM?
IAM Identity Center:
  • Centralized workforce identity management
  • Single sign-on to multiple AWS accounts
  • Permission sets define access levels
  • Integrates with external IdPs (Okta, Azure AD)
  • Temporary credentials via STS
Traditional IAM:
  • Per-account user management
  • Long-term credentials (access keys)
  • Policies attached directly to users/groups
Best Practice: Use Identity Center for human access, IAM for service accounts/roles.
LAB 12
Advanced
Q24: What is the IAM policy condition key `aws:MultiFactorAuthPresent`? How would you use it?
Purpose: Allows policies to check if MFA was used in the current session.

Example Use Case: Allow read access always, but require MFA for destructive actions.
{
  "Effect": "Deny",
  "Action": "ec2:TerminateInstances",
  "Resource": "*",
  "Condition": {
    "BoolIfExists": {
      "aws:MultiFactorAuthPresent": "false"
    }
  }
}
Note: CLI users must call sts:GetSessionToken with MFA to set this.
LAB 10
Intermediate
Q25: What is IAM Access Analyzer? What can it detect?
Access Analyzer: Uses automated reasoning to identify resources shared externally.

Detects:
  • S3 buckets accessible from outside your account
  • IAM roles with cross-account trust
  • KMS keys with external access
  • Lambda functions with resource-based policies
  • SQS queues with public access
Additional Features:
  • Policy validation against best practices
  • Policy generation from CloudTrail activity
LAB 10

AWS IAM Scenario Questions

Scenario
Q26: A developer's AWS access keys were accidentally committed to GitHub. What's your immediate response?
Immediate Actions (within minutes):
  1. Disable the key:IAM User Security credentials Deactivate key
  2. Check CloudTrail: Look for unauthorized activity since key creation
  3. Rotate credentials: Create new keys, update applications
  4. Delete compromised key
  5. Scan for damage: New resources? Modified settings? Data exfiltration?
  6. Incident report: Document timeline and impact
Prevention: Use git-secrets, enable GuardDuty, prefer roles over keys.
Scenario
Q27: Your company is migrating from single AWS account to multi-account. Design the strategy.
Account Structure:
  • Management: Organizations, billing only (minimal workloads)
  • Security: CloudTrail aggregation, GuardDuty admin, Security Hub
  • Log Archive: Centralized immutable logs
  • Network: Transit Gateway, VPN, Direct Connect
  • Shared Services: CI/CD, container registry
  • Workloads: Dev/Staging/Prod per application
Implementation:
  1. Enable AWS Organizations
  2. Create OU structure
  3. Deploy Control Tower for governance
  4. Configure IAM Identity Center for SSO
  5. Apply SCPs for guardrails
  6. Set up centralized logging
LAB 11, LAB 12

Part 3: Azure / Entra ID Interview Questions

Microsoft Entra ID (formerly Azure AD) is the enterprise identity platform of choice for many organizations. These questions cover identity management, SSO, conditional access, and governance.

Beginner
Q28: What is Microsoft Entra ID? How does it differ from on-premises Active Directory?
Entra ID (Azure AD):
  • Cloud-based identity service
  • REST API / OAuth / SAML / OIDC protocols
  • Multi-tenant, global scale
  • Supports modern authentication
On-premises AD:
  • LDAP / Kerberos protocols
  • Domain-based, forest/trust model
  • Requires domain controllers
  • Group Policy for management
Key Point: They're different systems that can sync via Entra Connect.
LAB 8
Intermediate
Q29: Explain Conditional Access in Entra ID. What signals does it evaluate?
Conditional Access: Real-time access decisions based on signals.

Signals:
  • User/Group: Who is accessing
  • Application: What they're accessing
  • Device: Managed? Compliant? Platform?
  • Location: Named locations, IP ranges
  • Risk: Sign-in risk, user risk (Identity Protection)
  • Client App: Browser, mobile app, legacy
Controls: Block, Allow, Require MFA, Require compliant device, Require ToU.
LAB 8
Intermediate
Q30: What is Privileged Identity Management (PIM)? How does it work?
PIM: Just-in-Time privileged access management for Entra ID and Azure roles.

Features:
  • Eligible vs Active: User is eligible but must activate
  • Activation: Request with justification, optional approval
  • Time-bound: Access expires after configured duration
  • MFA: Required for activation
  • Audit: Full trail of who activated what, when, why
  • Access Reviews: Periodic certification of eligibility
LAB 8
Advanced
Q31: Describe Entra ID Governance. What are Access Packages?
Entra ID Governance: Lifecycle management for identities and access.

Access Packages:
  • Bundle of resources (groups, apps, SharePoint sites)
  • Users request via My Access portal
  • Approval workflows (multi-stage)
  • Automatic expiration
  • Periodic access reviews
Use Case:New contractor needs Engineering project access Requests "Engineering Contractor" access package Manager approves Gets all required groups/apps for 90 days.
LAB 9
Advanced
Q32: What are Lifecycle Workflows in Entra ID? Explain Joiner/Mover/Leaver automation.
Lifecycle Workflows: Automated identity lifecycle based on triggers.

Joiner Workflow:
  • Trigger: employeeHireDate
  • Actions: Enable account, add to groups, send welcome email, generate TAP
Mover Workflow:
  • Trigger: department attribute change
  • Actions: Trigger access review, notify manager, update groups
Leaver Workflow:
  • Trigger: employeeLeaveDateTime
  • Actions: Disable account, remove groups, revoke access packages, remove app assignments
LAB 9
Intermediate
Q33: What is a Managed Identity in Azure? Types and use cases?
Managed Identity: Azure-managed service principal for workload authentication.

System-Assigned:
  • 1:1 with Azure resource (VM, App Service)
  • Lifecycle tied to resource
  • Deleted when resource is deleted
User-Assigned:
  • Standalone identity resource
  • Can be assigned to multiple resources
  • Independent lifecycle
Benefit: No credentials to manage - Azure handles authentication automatically.
LAB 9
Scenario
Q34: Design a Conditional Access strategy for a company with 5000 users, mix of corporate and BYOD devices.
Strategy:
  1. Baseline Policy (All Users): Require MFA for all cloud apps
  2. Corporate Devices:If Intune compliant allow with session controls
  3. BYOD: Require MAM policy OR block download of sensitive data
  4. High-Risk Sign-ins: Block or require password change
  5. Admins: Require MFA + compliant device + named location
  6. Guest Users: Require MFA + ToU acceptance
  7. Legacy Auth: Block (no MFA support)
Named Locations: Define corporate IPs as trusted.
LAB 8

Part 4: GCP IAM Interview Questions

GCP IAM has a unique resource hierarchy model. These questions test your understanding of Google Cloud's approach to identity and access management.

Beginner
Q35: Explain the GCP resource hierarchy. How does IAM inheritance work?
Hierarchy (top to bottom):
  • Organization: Root, tied to Cloud Identity domain
  • Folders: Organizational grouping (departments, environments)
  • Projects: Container for resources, billing boundary
  • Resources: GCS buckets, VMs, BigQuery datasets
Inheritance:Roles granted at higher level apply to all resources below. Organization Folders Projects Resources.
LAB 13
Intermediate
Q36: What are the different types of IAM roles in GCP?
Basic Roles (avoid in production):
  • Owner, Editor, Viewer - very broad
Predefined Roles:
  • Service-specific, created by Google
  • roles/storage.admin, roles/compute.viewer
  • Follow least privilege better than basic
Custom Roles:
  • User-defined, specific permissions
  • Can be project or org level
  • Best for exact permission requirements
LAB 13
Advanced
Q37: What is Workload Identity Federation in GCP? How does it work with GitHub Actions?
Workload Identity Federation: Allows external workloads to authenticate without service account keys.

Components:
  • Workload Identity Pool: Container for external identities
  • Provider: Trust configuration (GitHub, AWS, Azure)
  • Attribute Mapping: Map external claims to GCP attributes
GitHub Actions Flow:
  1. GitHub Action requests OIDC token from GitHub
  2. Token exchanged with GCP STS for federated token
  3. Federated token used to impersonate service account
  4. No long-lived keys needed!
LAB 13
Intermediate
Q38: Why should you avoid service account keys? What alternatives exist?
Problems with Keys:
  • Long-lived credentials - if leaked, persistent access
  • Difficult to rotate at scale
  • Often committed to code repositories
  • No automatic expiration
Alternatives:
  • Attached Service Account: For GCE, Cloud Run, GKE
  • Workload Identity: For GKE pods
  • Workload Identity Federation: For external systems
  • Impersonation: User impersonates SA (auditable)
Best Practice: Disable key creation via org policy.
LAB 13
Intermediate
Q39: What are Organization Policies in GCP? Give examples of security constraints.
Organization Policies: Centralized constraints applied across the org hierarchy.

Common Security Constraints:
  • iam.disableServiceAccountKeyCreation - No SA keys
  • compute.vmExternalIpAccess - Control public IPs
  • storage.uniformBucketLevelAccess - Enforce uniform access
  • gcp.resourceLocations - Restrict regions
  • compute.requireOsLogin - Force OS Login for VMs
LAB 13

Part 5: PAM & CyberArk Interview Questions

Privileged Access Management is critical for enterprise security. These questions cover PAM concepts and CyberArk-specific implementation details.

Beginner
Q40: What is the CyberArk Digital Vault? What does it store?
Digital Vault: Hardened, encrypted repository for privileged credentials.

Stores:
  • Passwords for privileged accounts
  • SSH keys
  • Certificates
  • API keys and tokens
  • Cloud credentials
Security: Multi-layer encryption, air-gapped options, tamper-evident logging.
LAB 6
Intermediate
Q41: Explain the CyberArk components: Vault, PVWA, CPM, PSM.
Vault: Secure storage for credentials (heart of CyberArk)

PVWA (Password Vault Web Access): Web interface for users and admins

CPM (Central Policy Manager): Automates password rotation per policy

PSM (Privileged Session Manager): Proxies and records privileged sessions

Additional:
  • PSMP: PSM for SSH sessions
  • AAM: Application Access Manager for apps
  • CCP: Central Credential Provider (REST API)
LAB 6
Intermediate
Q42: What is a Safe in CyberArk? How are permissions managed?
Safe: Logical container for accounts within the Vault.

Permission Model:
  • Safes have Safe Members (users/groups)
  • Each member has specific permissions
  • Permissions: Retrieve, List, Add, Update, Delete, Manage Safe
Organization:
  • By platform: Windows-Servers, Unix-Servers, Databases
  • By team: DBA-Safe, Network-Safe
  • By environment: Prod-Safe, Dev-Safe
LAB 6
Advanced
Q43: Explain CyberArk PSM architecture. How does session isolation work?
PSM Architecture:
  1. User connects to PSM server (not target directly)
  2. PSM retrieves credentials from Vault
  3. PSM initiates session to target on user's behalf
  4. User sees target screen via RDP/SSH proxy
  5. Credentials never exposed to user
  6. Full session recorded to Vault
Isolation:
  • User PSM (controlled jump box)
  • PSM Target (credentials injected)
  • No direct user-to-target connection
LAB 6
Scenario
Q44: A CPM rotation fails for a critical database account. Walk through troubleshooting.
Troubleshooting Steps:
  1. Check account status in PVWA: Last rotation time, failure reason
  2. Review CPM logs: ITALog.log, PMConsole.log
  3. Verify reconcile account: Does CPM have valid credentials to connect?
  4. Test connectivity: Can CPM reach target on required port?
  5. Check platform configuration: Correct rotation script?
  6. Verify target permissions: Can reconcile account change passwords?
  7. Manual test: Try rotation manually to isolate issue
Common Causes: Network firewall, expired reconcile account, platform misconfiguration.
Advanced
Q45: How do you secure applications that need to retrieve credentials from CyberArk?
Options:
  • CCP (Central Credential Provider): REST API, application authenticates with cert/IP
  • CP (Credential Provider): Local agent, app calls local API
  • Conjur: Secrets management for DevOps/containers
Security Controls:
  • Whitelist calling application by hash, path, IP
  • Require client certificate authentication
  • Limit credential retrieval to specific Safe
  • Audit all retrievals
  • No hardcoded AppID/Safe names in code
LAB 6

Part 6: Real-World Scenario Questions

These scenario-based questions test your ability to apply IAM knowledge to real enterprise situations. Interviewers use these to evaluate problem-solving skills.

Scenario
Q46: You're implementing IAM for a healthcare company (HIPAA). What special considerations?
HIPAA IAM Requirements:
  • Minimum Necessary: Least privilege strictly enforced
  • Unique User IDs: No shared accounts
  • Automatic Logoff: Session timeouts required
  • Audit Controls: Log all access to PHI
  • Access Reviews: Regular access certification
  • Emergency Access: Break-glass procedures documented
Implementation:
  • MFA for all users accessing PHI
  • Conditional Access based on device/location
  • Detailed audit logging (who viewed what patient record)
  • Quarterly access reviews for PHI systems
  • Just-in-Time access for elevated privileges
Scenario
Q47: A company acquires another company. How do you merge their identity systems?
M&A Identity Integration Strategy:
  1. Assessment: Inventory both identity systems (AD, Okta, Azure AD?)
  2. Short-term (Day 1):
    • Establish cross-organization trust/federation
    • Enable SSO between systems
    • Unified MFA policy
  3. Medium-term (90 days):
    • Consolidate on single IdP
    • Migrate users in phases
    • Unified RBAC model
  4. Long-term:
    • Single identity source of truth
    • Decommission legacy systems
    • Unified governance
Scenario
Q48: You notice 340 orphaned accounts in your audit. How do you address this?
Orphaned Account Remediation:
  1. Identify: Cross-reference IAM users with HR system
  2. Categorize:
    • Terminated employees (urgent)
    • Service accounts (validate ownership)
    • Contractors with expired contracts
  3. Immediate: Disable accounts with no HR match
  4. Investigate: Review activity logs for suspicious access
  5. Delete: After 30-day disabled period
  6. Prevent: Implement lifecycle workflows (automated deprovisioning)
LAB 7, LAB 9
Scenario
Q49: Design a Zero Trust architecture for remote-first company with 2000 employees.
Zero Trust Design:
  • Identity (Foundation):
    • Strong authentication (MFA for all)
    • Risk-based conditional access
    • Continuous session validation
  • Devices:
    • Device compliance required (MDM/Intune)
    • Endpoint detection and response (EDR)
    • Device health attestation
  • Network:
    • ZTNA (Zero Trust Network Access) vs VPN
    • Micro-segmentation
    • No implicit trust for internal networks
  • Applications:
    • Per-app authentication
    • Just-in-Time access for sensitive apps
  • Data:
    • Data classification
    • DLP policies
    • Encryption at rest and in transit
LAB 3, LAB 8
Scenario
Q50: How would you implement privileged access for a DevOps team using CI/CD pipelines?
DevOps Privileged Access Strategy:
  • Eliminate Long-Lived Secrets:
    • AWS: Use OIDC federation with GitHub/GitLab
    • Azure: Managed Identity + Workload Identity Federation
    • GCP: Workload Identity Federation
  • Pipeline Service Accounts:
    • Dedicated SA per pipeline/environment
    • Least privilege for deployment actions only
    • No interactive login capability
  • Secrets Management:
    • Store secrets in vault (HashiCorp, AWS Secrets Manager)
    • Fetch at runtime, never in code
    • Automatic rotation
  • Human Access:
    • JIT access via PIM for production
    • Emergency break-glass procedures
    • All sessions recorded
LAB 9, LAB 10, LAB 13

Portfolio Building Guide

Your portfolio demonstrates practical skills to employers. Here's how to turn these labs into impressive portfolio projects.

Step 1: Document Your Lab Work

For each lab completed, create structured documentation:

Step 2: Portfolio Projects from Labs

Project 1: Enterprise Azure AD / Entra ID Implementation

Based on: LAB 7, LAB 8, LAB 9

Entra ID Conditional Access PIM Lifecycle Workflows

What to showcase:

  • Multi-tenant architecture diagram
  • Conditional Access policy matrix (environments × user types)
  • PIM configuration for administrative roles
  • Automated Joiner/Mover/Leaver workflows
  • Access review dashboard design

Project 2: Multi-Account AWS Security Architecture

Based on: LAB 10, LAB 11, LAB 12

AWS Organizations Control Tower IAM Identity Center SCPs

What to showcase:

  • Organization structure diagram (OUs, account types)
  • SCP policy examples with explanations
  • Permission set designs for different roles
  • Centralized logging architecture
  • Cross-account access patterns

Project 3: GCP IAM with Workload Identity Federation

Based on: LAB 13

GCP IAM Workload Identity Custom Roles Organization Policies

What to showcase:

  • Resource hierarchy design
  • Custom role definitions with least privilege
  • GitHub Actions GCP authentication setup
  • Organization policy constraints
  • IAM Recommender analysis

Project 4: Identity Federation & SSO Implementation

Based on: LAB 4, LAB 5, LAB 8

SAML 2.0 OIDC Keycloak SCIM

What to showcase:

  • Federation architecture diagram
  • SAML configuration walkthrough
  • OIDC token flow explanation
  • User provisioning with SCIM
  • MFA integration

Step 3: Create Your GitHub Portfolio

iam-portfolio/
README.md # Overview of all projects
azure-entra-implementation/
README.md
architecture/
diagrams/ # Architecture diagrams
conditional-access/
policies.json # CA policy exports
pim/
role-settings.md # PIM configurations
screenshots/ # Redacted screenshots
aws-multi-account/
README.md
organization/
structure.md
scps/
deny-regions.json
deny-root.json
protect-security.json
permission-sets/
developer-access.json
terraform/ # IaC examples
gcp-iam/
README.md
custom-roles/
workload-identity/
certifications/
credentials.md # Your certs

How to Showcase Your Skills

Having skills is one thing—demonstrating them effectively is another. Here's how to make your IAM expertise visible to employers.

Showcase Platforms

GitHub Portfolio

Public repo with README, architecture diagrams, code samples, documentation

Technical Blog

Write about labs completed, challenges solved, lessons learned

LinkedIn Profile

Projects section, certifications, skills endorsements

Video Demos

YouTube walkthroughs of implementations (sanitized)

Speaking

Meetups, conferences, webinars on IAM topics

Social Media

Share insights, engage with IAM community

LinkedIn Optimization

LinkedIn Profile Tips
  • Headline: "IAM/PAM Engineer | AWS | Azure AD | CyberArk | Zero Trust"
  • About: Lead with impact (e.g., "Implemented SSO for 10,000 users...")
  • Featured: Link to portfolio, blog posts, certifications
  • Experience: Use metrics and specific technologies
  • Skills: Add: IAM, PAM, AWS IAM, Azure AD, SAML, OIDC, Zero Trust
  • Projects: Add each portfolio project with descriptions

Resume Bullet Points (From Labs)

AWS Multi-Account Architecture:
• Designed and implemented AWS Organizations structure with 5 OUs and 15 accounts
• Created 8 SCPs enforcing security guardrails across organization
• Configured IAM Identity Center with SAML federation reducing credential management by 80%

Azure AD / Entra ID Implementation:
• Implemented Conditional Access policies protecting 5,000 users across 50 applications
• Configured Privileged Identity Management reducing standing admin access by 95%
• Automated identity lifecycle with workflows processing 200+ monthly changes

PAM Implementation:
• Deployed CyberArk PAM solution managing 2,000+ privileged accounts
• Configured session recording achieving 100% coverage for privileged access
• Reduced password rotation from manual 90-day cycle to automated daily rotation

Interview Preparation Checklist

Success Formula

Skills (Labs) + Documentation (Portfolio) + Visibility (Showcase) + Credentials (Certs) = Career Success

The combination of hands-on skills from these labs, documented proof in your portfolio, public visibility through blogging/speaking, and industry certifications creates a compelling professional profile.

Recommended Certifications to Complement Labs

CertificationLabs AlignmentFocus
AWS Certified Security - SpecialtyLAB 10, 11, 12AWS IAM, Organizations, Security
Microsoft SC-300LAB 7, 8, 9Entra ID, Conditional Access, Governance
Google Cloud Security EngineerLAB 13GCP IAM, Organization Policies
CyberArk Defender / SentryLAB 6PAM Administration
Okta Certified AdministratorLAB 5Okta SSO, Lifecycle Management
CISSPAllOverall Security, IAM Domain