SY0-701 Security Architecture Practice Question
A company uses several SaaS applications and wants employees to sign in once with a corporate account instead of maintaining separate passwords for each app. Which architecture is best?
⚠ Common exam trap
Watch out — candidates often confuse network-level VPN connectivity with identity-level federation, assuming a VPN can provide SSO, when in fact VPNs only secure the transport layer and do not address authentication across separate application domains.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Federated single sign-on with a central identity provider.
Federated single sign-on (SSO) with a central identity provider (IdP) allows users to authenticate once using their corporate account (e.g., via SAML 2.0 or OIDC) and then access multiple SaaS applications without re-entering credentials. The IdP issues a token that each SaaS app trusts, eliminating the need for separate passwords while maintaining centralized control over authentication policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shared generic accounts for each department.
Why it's wrong here
Shared generic accounts for each department eliminate individual accountability because every user authenticates with the same credentials. This breaks non-repudiation, as audit logs cannot attribute actions to a specific employee, and it creates a significant insider-threat risk. Revoking access for one person forces a password change that affects the entire department, and in many SaaS terms of service, credential sharing is prohibited, creating compliance exposure.
- ✓
Federated single sign-on with a central identity provider.
Why this is correct
This is the best choice because a central identity provider can authenticate the user once and then issue trusted access to multiple SaaS applications. It reduces password sprawl, simplifies account provisioning, and supports faster deprovisioning when an employee leaves. Federation also improves control because the business can manage identity from one place.
- ✗
A separate username and password database in every SaaS application.
Why it's wrong here
Maintaining separate username and password databases in each SaaS application creates identity silos, inconsistent password policies, and high administrative overhead for onboarding, offboarding, and password resets. Users are forced to remember multiple credentials, which often leads to password reuse and increased vulnerability to credential-stuffing attacks. When an employee leaves, orphaned accounts may remain active indefinitely, posing a delayed security risk and complicating compliance audits.
- ✗
A site-to-site VPN for every SaaS vendor.
Why it's wrong here
Site-to-site VPNs only secure network traffic flows and do not address application-level authentication or authorization. SaaS vendors typically do not allow customers to terminate VPNs inside their infrastructure, so such tunnels would not integrate with the SaaS identity system or reduce the need for separate logins. Moreover, maintaining VPN connections to every vendor adds latency and management complexity without solving identity lifecycle, federation, or single sign-on requirements.
Go deeper
Related to this question
Learn chapter
DMZ Architecture and Design
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
SSO
Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications or systems with one set of login credentials.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.