Work through these on your own. Try each before opening the solution. Part A checks that you can place tools and domains correctly (exam-style); Part B is hands-on in the lab; Part C tests how the policy engine reasons.
Part A — Concept checks
Which single tool is the only writer of the directory, and why is that rule so important?
Solution
A scenario describes running quarterly campaigns where managers confirm their team's access is still appropriate. Which tool category and CRD?
Solution
The Portal never stores a password. When a user visits it, how do they prove who they are, and what token/protocol is involved?
Solution
Explain the difference between OPA and the Golonex Portal in one sentence each.
Solution
The lab has two PAM-style tools. Name them and give one thing that distinguishes them.
Solution
In the capstone, a terminated employee's login attempt triggers a SIEM alert. What is the underlying technical signal, and why does it occur?
Solution
LOGIN_ERROR with error user_not_found. After termination, midPoint disables the account and Keycloak's federation filter hides disabled accounts — so to Keycloak the username no longer resolves. Wazuh's rule fires on that as a "possible post-termination access attempt".Which two Critical Risk Domains does this lab not perform hands-on, and why is that reasonable?
Solution
Part B — Hands-on exercises
Seeded users (password Welcome2026!): bob.builder (IT), carol.chen (Finance mgr/approver), dave.dixon (HR), erin.evans (AP clerk). All solutions below were run in the live lab.
Onboard a new employee — Priya Patel, department IT, "Service Desk Analyst" — from the HR feed, and prove she can log in. What access does she get automatically, and why?
Solution
app-users membership. She logs into the Portal with groups=[app-users]. Baseline access is automatic because the birthright role is auto-assigned to every HR-sourced identity.Grant Priya the HR Staff entitlement through the proper request path. Does it take effect immediately? Who must act?
Solution
hr-staff group. (It is also department-scoped, so it is only effective while the holder is in HR — the teaching point here is the approval routing.)erin.evans is an AP clerk. Try to also grant her the AP Approver role. What happens, and what is she left holding?
Solution
finance-ap-clerk; the approver role is never granted. And OPA would deny all finance actions to anyone holding both.Move a Finance AP clerk to the IT department in HR and re-run the import. What happens to their Finance entitlement, and why?
Solution
finance-ap-clerk entitlement is automatically removed — that role is scoped to Finance, so leaving Finance strips it; the directory group membership drops to baseline (app-users). This is how attribute-scoped roles prevent "access creep".Run a directory reconciliation. One account is flagged as unmatched. Which one, and what makes it an orphan?
Solution
Off-board Priya (set status terminated, re-run import). Confirm she can no longer log in. Then attempt her old credentials and find the SIEM alert. What severity and message?
Solution
Open a privileged session to a server through Teleport (or Guacamole), run a command, then locate the recording. What did you have to provide that a normal login does not require?
Solution
Part C — Authorization challenges (OPA)
For each case, predict the decision — ALLOW or DENY, and the reason — before revealing the
answer. The policy: everyone may view home; HR actions need hr-staff; invoice creation needs
finance-ap-clerk; payment approval needs finance-ap-approver, and above
50,000 also needs access-approvers; admin needs it-admins; and holding
both finance roles is a segregation-of-duties violation that denies all finance actions. All 15
answers were validated against the live policy engine.
| # | Groups the user holds | Action (amount) | Your call |
|---|---|---|---|
| C1 | app-users | home.view | ? |
| C2 | hr-staff | hris.edit | ? |
| C3 | hr-staff | admin.view | ? |
| C4 | finance-ap-clerk | invoice.create | ? |
| C5 | finance-ap-clerk | payment.approve (100) | ? |
| C6 | finance-ap-approver | payment.approve (5,000) | ? |
| C7 | finance-ap-approver | payment.approve (75,000) | ? |
| C8 | finance-ap-approver, access-approvers | payment.approve (75,000) | ? |
| C9 | finance-ap-clerk, finance-ap-approver | invoice.create | ? |
| C10 | it-admins | admin.view | ? |
| C11 | finance-ap-approver | payment.approve (exactly 50,000) | ? |
| C12 | finance-ap-approver | payment.approve (50,001) | ? |
| C13 | (none) | home.view | ? |
| C14 | finance-ap-clerk, finance-ap-approver | finance.view | ? |
| C15 | app-users | invoice.create | ? |
Solutions (validated against the live policy engine)
| # | Decision | Reason |
|---|---|---|
| C1 | ALLOW | the home page is public to any signed-in user |
| C2 | ALLOW | HR edit requires hr-staff — held |
| C3 | DENY | missing entitlement (admin needs it-admins) |
| C4 | ALLOW | invoice creation requires finance-ap-clerk — held |
| C5 | DENY | missing entitlement (approval needs finance-ap-approver) |
| C6 | ALLOW | approver, amount ≤ 50,000 |
| C7 | DENY | amount above 50,000 requires a manager (access-approvers) |
| C8 | ALLOW | approver + manager, so the large amount is permitted |
| C9 | DENY | SoD violation — holds both finance-ap-clerk and finance-ap-approver |
| C10 | ALLOW | admin view requires it-admins — held |
| C11 | ALLOW | boundary: exactly 50,000 is within the approver's limit |
| C12 | DENY | boundary: 50,001 is above the limit → needs a manager |
| C13 | ALLOW | home is public even with no groups |
| C14 | DENY | SoD violation also blocks reading finance, not just writing |
| C15 | DENY | a baseline user has no finance entitlement |
Watch C11/C12 (the threshold is ≤ 50,000) and C14 (SoD denies every finance action, including read-only ones).