SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create separate usernames and passwords for each SaaS application and disable browser-based token sharing.

  Why it's wrong here

  This approach forces users to maintain a separate credential for every SaaS platform, which creates password sprawl and increases the likelihood of password reuse or phishing attacks. Disabling browser-based token sharing prevents any session from being reused across apps, further fragmenting the authentication experience and making it impossible to enforce centralized conditional access based on device posture or network location. Without a central identity provider, IT also loses the ability to apply consistent MFA or adaptive risk policies across the ecosystem.

• ✓

  Implement federated identity with single sign-on and conditional access policies tied to device posture and network location.

  Why this is correct

  Federation lets the organization use one identity provider for multiple SaaS applications, which enables single sign-on. Conditional access then adds policy-based decisions such as requiring MFA for unmanaged devices or external access. This combination is both more secure and more user-friendly than separate credentials or blanket MFA for every sign-in.

• ✗

  Use local accounts in each SaaS application and rotate passwords every 30 days.

  Why it's wrong here

  Using local accounts in each SaaS application means user onboarding, offboarding, and role changes must be manually repeated across every system, leaving orphaned accounts and elevating the risk of unauthorized access when employees leave. Rotating passwords every 30 days is an obsolete control that encourages predictable password variations and does not stop credential phishing or credential stuffing. This approach neither provides single sign-on nor supports adaptive policies like requiring MFA only for high-risk sessions, so it fails both security and user-experience goals.

• ✗

  Grant all employees the same access role to simplify authentication and reduce support tickets.

  Why it's wrong here

  Granting all employees the same access role abandons least privilege, meaning a compromised low-level account could grant an attacker full access to every SaaS application in the environment. It also eliminates the ability to tailor access decisions based on job function, sensitivity of data, or context such as device compliance and network location, turning conditional access into an all-or-nothing decision. While it may reduce support tickets in the short term, it drastically increases the blast radius of any single credential compromise and exposes the organization to insider misuse and regulatory violations.

Go deeper

Related to this question