SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Set up MFA, conditional access, and user-role assignments for tenant accounts.

  Why this is correct

  In a SaaS model, the provider owns the application, but the customer remains responsible for tenant-level identity controls. This means configuring multi-factor authentication for every account, setting conditional access rules to restrict sign-ins by device risk or geolocation, and assigning role-based permissions using the app's native admin center or an integrated identity provider like Azure AD. Without these controls, a single compromised credential can expose the entire tenant, regardless of how well the provider patches its code.

• ✗

  Patch the SaaS application's source code on the provider's servers.

  Why it's wrong here

  The SaaS provider applies its own updates to the shared application code on a regular cadence, and customers have no direct access to the underlying servers or source repository. If a customer tried to patch that source code, they would need credentials and infrastructure that the provider deliberately withholds to maintain security and multi-tenant isolation. Moreover, such action is contractually prohibited and would likely cause the tenant to lose support, so it is neither a feasible nor a shared responsibility.

• ✓

  Decide what customer data is entered into the service and how it is shared.

  Why this is correct

  The customer, not the provider, determines what data is submitted to the SaaS platform and how that data is shared with external parties or other modules within the service. This includes classifying data at rest, setting cross-tenant sharing permissions, configuring export and deletion policies, and ensuring privacy regulations such as GDPR or HIPAA are satisfied through appropriate measures. Even though the provider stores the raw bytes, the customer carries the data-owner accountability for any breach or misuse of that information.

• ✗

  Replace the provider's hypervisors with company-owned hardware.

  Why it's wrong here

  In a SaaS stack, the hypervisor and the physical hosts that run it are part of the provider's responsibility, and the customer is only granted API-level or UI-level access to the application. To replace the hypervisor, the customer would need physical access to the datacenter, direct management of the virtualization layer, and the ability to migrate live workloads — none of which are exposed to tenants in a logically isolated environment. Attempting such a replacement would disrupt availability, void the provider's SLAs, and introduce security risks that the customer is not equipped to mitigate.

• ✗

  Maintain the provider's network firewalls and datacenter cooling systems.

  Why it's wrong here

  Physical infrastructure maintenance — including network firewalls, cooling systems, power feeds, and server room access controls — is exclusively in the provider's domain in a SaaS arrangement. The customer cannot even view the datacenter topology, let alone configure edge firewalls or monitor HVAC thresholds, because those operational functions are hidden behind the abstraction of the service. These responsibilities are also covered by the provider's SOC 2 and ISO 27001 certifications, so transferring them to the customer would invalidate those compliance assurances.

Go deeper

Related to this question