What core security controls are emphasized for identity and access management in MDC3?

• A. MFA, RBAC/ABAC, least privilege, and audit logging to enforce secure access in MDC3.
• B. Only antivirus software.
• C. Public access by default.
• D. Never log events.

Answer: (A)

Identity and access management is about proving who a user is, controlling what they can do, and keeping a record of access events. Multi-factor authentication adds an extra verification step beyond a password, making it harder for attackers to misuse stolen credentials. Role-based access control and attribute-based access control provide structured ways to grant permissions based on a user’s role or attributes, so people have access only to what they need. The principle of least privilege tightens this further by limiting rights to the minimum necessary for the job, reducing potential damage from mistakes or compromises. Audit logging creates traceability, allowing you to see who accessed what and when, which is essential for detecting abnormal activity and investigating incidents.

Together, these controls reinforce secure access in MDC3. Antivirus software addresses device protection rather than identity and access management, public or open access by default contradicts IAM principles, and not logging events eliminates visibility and accountability, undermining IAM effectiveness.