SY0-701 Security Architecture Practice Question
A company wants employees to use one corporate login for multiple SaaS applications, require MFA when users sign in from unmanaged devices, and centralize account lifecycle management. Which design best meets these requirements?
⚠ Common exam trap
Test-takers frequently confuse 'shared accounts' (Option B) with SSO, not realizing that shared accounts lack individual accountability and cannot enforce per-user MFA or conditional access policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement federated single sign-on through a central identity provider with MFA and conditional access policies.
Federated single sign-on (SSO) through a central identity provider (IdP) like Azure AD or Okta allows employees to use one corporate login across multiple SaaS applications via protocols such as SAML 2.0 or OIDC. The IdP enforces MFA for unmanaged devices through conditional access policies (e.g., device compliance checks) and centralizes account lifecycle management by provisioning/deprovisioning users from a single directory (e.g., LDAP or SCIM).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create separate local usernames and passwords in each SaaS application.
Why it's wrong here
Creating separate local usernames and passwords inside each SaaS app creates disconnected identity silos. There is no central provisioning or deprovisioning, so when an employee leaves, their access must be manually revoked in every service, increasing risk of orphaned accounts. Users also face password fatigue and are more likely to reuse weak credentials, while the organization cannot enforce a single MFA policy or conditional access across applications.
- ✗
Use shared accounts for each department and keep one password vault for the team.
Why it's wrong here
Departmental shared accounts with a team password vault eliminate individual accountability because all users authenticate as the same generic identity. This breaks audit trails, makes it impossible to attribute specific actions to a particular user, and prevents MFA from being tied to an individual's context. Even with a vault, the passwords are static shared secrets, so compromised credentials would affect every team member and violate least-privilege principles.
- ✓
Implement federated single sign-on through a central identity provider with MFA and conditional access policies.
Why this is correct
Federated SSO lets the identity provider authenticate users once and pass trusted assertions to multiple SaaS apps. MFA can be enforced centrally, and conditional access can require additional controls based on device trust or location. This also simplifies account creation, removal, and policy management.
- ✗
Require all users to connect through a VPN before any SaaS login and remove identity federation.
Why it's wrong here
Requiring a VPN before SaaS logins only controls network access; it does not provide identity federation or app-level authorization. Without a central identity provider asserting a user's identity, each SaaS application still requires separate authentication, leaving the original problem unsolved. VPNs also enforce device-level access rather than per-user, per-application conditional access, and they degrade performance while adding complexity for remote users without eliminating SSO needs.
Go deeper
Related to this question
Learn chapter
VPN Types and Protocols
Key term
SAML
Security Assertion Markup Language (SAML) is an open standard that allows one system to securely tell another system that a user is who they say they are, without sharing the user's password.
Key term
LDAP
LDAP is a protocol used to access and manage directory information over a network, such as user accounts and permissions.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.