Fixed credentials that people memorize and reuse, entered at every login, are described as static passwords. They remain the same until the user or administrator changes them, which makes them the traditional form of access secret rather than something that changes automatically. This is in contrast to dynamic options like one-time passwords, which are valid for a single session or a short window. A digital certificate, while also used for authentication, is not a password but a cryptographic credential issued within a PKI system. MFA refers to using multiple factors for authentication, not to a single, fixed secret. Static passwords capture the idea of a constant secret used for access.

Regular checks for security weaknesses are performed through vulnerability scanning. Vulnerability scanning uses automated tools to continuously or periodically scan devices, systems, and applications for known vulnerabilities, missing patches, misconfigurations, and weak credentials. It provides actionable reports that guide remediation, making it a proactive way to reduce risk by identifying issues before attackers exploit them. Data encryption protects data confidentiality but does not discover weaknesses. Incident response planning focuses on detecting and responding to incidents after they occur, not on ongoing discovery of vulnerabilities. Network segmentation controls how access is granted and limits movement within the network, but it doesn’t perform regular vulnerability checks. Penetration testing simulates attackers and is typically done less frequently and more manually, whereas vulnerability scanning is designed for regular, automated checks.

Single Sign-On is the centralized mechanism that lets a user authenticate once and then access multiple services within the same realm without re-entering credentials. In practice, an identity provider handles the login and issues a trusted token or session. Service providers within the realm accept that token to authorize access, so the user can move between different applications seamlessly. This reduces password prompts and creates a consistent, secure gateway for access. Access Management describes the policies and enforcement around who can access which resources, not the single-login flow itself. Identity Store is simply where credentials and identities are stored. Federation covers establishing trust between separate domains to allow cross-domain SSO, which is broader and often involves multiple realms. Within a single realm, the term that best matches the described mechanism is Single Sign-On.

Identity-related risk is what IAM must reduce. When credentials are stolen or someone impersonates a legitimate user, unauthorized access to systems and data becomes possible. This is the scenario we call identity theft in the IT context, and IAM is designed to prevent it by properly verifying users (authentication), granting only necessary permissions (authorization and least privilege), and continuously monitoring for anomalous activity. Strong authentication methods such as multi-factor authentication, adaptive access controls, and rigorous credential management directly reduce the likelihood that stolen credentials can be used to harm the system. The other terms describe external pressures or planning aspects rather than the risk IAM is built to mitigate, so identity theft is the risk IAM strategies target most directly.