SY0-701 Security Architecture Practice Question
A company uses a third-party expense application and wants employees to sign in with their corporate identity once, then automatically lose access in the expense app when they are terminated in the HR system. Which solution best meets both requirements?
⚠ Common exam trap
A common mix-up: candidates think VPN or password synchronization provides adequate access control, but they fail to recognize that only federated SSO combined with automated provisioning/deprovisioning ensures both seamless authentication and immediate revocation tied to the corporate identity lifecycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement federated single sign-on and automated user provisioning and deprovisioning.
Federated single sign-on (SSO) allows users to authenticate once using their corporate identity (e.g., via SAML or OIDC), and automated provisioning/deprovisioning (often via SCIM) ensures that when an employee is terminated in the HR system, their access to the expense app is automatically revoked. This meets both requirements: seamless sign-in and immediate loss of access upon termination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create separate local usernames in the expense app and synchronize passwords weekly.
Why it's wrong here
Creating separate local usernames in the expense app duplicates identity data into another silo, increasing administrative overhead and creating a mismatch with the corporate directory. Syncing passwords only weekly leaves a window during which terminated or role-changed users retain valid credentials, violating least privilege and timely deprovisioning. Password sync also often involves storing or sending credentials in ways that weaken authentication security compared to a federated identity provider.
- ✓
Implement federated single sign-on and automated user provisioning and deprovisioning.
Why this is correct
Federated single sign-on, using SAML 2.0 or OIDC, lets employees authenticate with their existing corporate credentials through an identity provider (IdP), so the expense app never stores separate passwords. Automated provisioning via SCIM or similar APIs creates, updates, and disables accounts based on authoritative HR/directory data, ensuring deprovisioning happens in near real-time when an employee leaves or changes roles. This gives the company centralized visibility and control over access, reduces orphaned accounts, and satisfies audit requirements for identity lifecycle management.
- ✗
Require a VPN connection before users can open the expense app.
Why it's wrong here
Requiring a VPN before accessing the expense app only protects network-layer traffic and does nothing about identity federation or account lifecycle. It still relies on the app's own password-based local accounts, so a terminated employee would remain fully able to log in unless manually disabled, and there is no single sign-on convenience. VPNs also fail to address insider threats because a compromised endpoint with a valid VPN connection can reach the app without any additional identity-aware checks, providing no accountability or automated provisioning.
- ✗
Use a shared generic account for all employees and rotate the password monthly.
Why it's wrong here
A shared generic account destroys individual accountability because every user logs in with the same username and password, making it impossible to attribute actions to a specific employee in audit logs. Monthly password rotation does not mitigate this, as the password still has to be distributed to all users and anyone exfiliating it retains access until the next rotation. This approach violates the principle of least privilege, prevents the use of per-user MFA, and makes termination practically impossible without changing a password that everyone shares, disrupting all users.
Go deeper
Related to this question
Learn chapter
Web Application Firewall (WAF)
Key term
SAML
Security Assertion Markup Language (SAML) is an open standard that allows one system to securely tell another system that a user is who they say they are, without sharing the user's password.
Key term
Deprovisioning
Deprovisioning is the process of removing a user's access to systems and data when they no longer need it, typically when they leave an organization or change roles.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which integration best lets the SaaS application trust the company's existing identity provider so users can sign in with their corporate credentials?
medium- ✓ A.Establish SAML federation so the SaaS app trusts the corporate identity provider.
- B.Enable password synchronization so the SaaS app stores the same password as the directory.
- C.Create a shared local administrator account for all subsidiary users.
- D.Configure MAC address filtering on company laptops to allow portal access.
Why A: SAML (Security Assertion Markup Language) federation allows the SaaS application to trust the corporate identity provider (IdP) by exchanging signed XML assertions. This enables users to authenticate against their corporate credentials without the SaaS app ever storing or managing those credentials, providing single sign-on (SSO) across domains.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.