Services and web applications in the farm are configured when created/started to use an account. For web applications and service applications, these are linked to an application pool. There is a way to change service accounts as needed after a web application is created or a service is started. This video shows you how to do that.

SharePoint Farm Administrators can manage all of the services, configurations and settings at the Central Administration level. Anyone added to the farm administrators security group is provided these abilities. This video shows how to add people or groups from Active Directory to the farm administrators group.

When a SharePoint web application or a service application is created, a managed account is required to be configured to run the application pool for the service application or the web application. These managed accounts can be configured ahead of time. Watch this video to see how the process works.

An end user or an active directory group can be given a variety of permissions within a site collection. There is an easy way to check those permissions from the Site Permissions page.

A Permission Level can be thought of as a security role (such as Contribute, Design, Read). Users or SharePoint Groups are assigned to a security role to give them access to that security level. Permission levels are defined at the top level site of a site collection.

The built in SharePoint security groups are explored in this video – Owners, Members, Visitors and Viewers. It is shown how the user experience changes when you add them to one or more of these groups. Also, some best practice guidance is provided to help you get started with these groups.

A site collection is administered by site collection administrators. You pick a primary and secondary site collection administrator when a site collection is first created. You can add more administrators afterwards if you like and this video shows you how to can do that. Keep in mind that site collection administrators can administer any site within the site collection even they have not been explicity given permissions to a site.