SY0-701 General Security Concepts Practice Question
Exhibit
Current behavior: - Users sign in once through SSO - App caches role assignments locally for the browser session - Role changes are only noticed after logout - No app-specific passwords are stored
A finance app uses the corporate IdP for authentication. A user who moved out of finance can still approve invoices until the browser session expires, and the app caches local roles. Which two changes best make access changes take effect faster without storing app passwords? Select two.
⚠ Common exam trap
Watch out — candidates often think increasing password complexity or disabling SSO improves security, but the question specifically asks for changes that make access changes take effect faster without storing app passwords, so the focus must be on session/token lifetimes and authorization source, not authentication strength.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shorten token and session lifetimes, and require reauthentication for high-risk actions.
Shortening token and session lifetimes reduces the window during which stale permissions remain active, and requiring reauthentication for high-risk actions (like approving invoices) ensures that the user's current authorization status is verified before sensitive operations. This directly addresses the problem of cached roles persisting beyond the user's actual group membership changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Shorten token and session lifetimes, and require reauthentication for high-risk actions.
Why this is correct
Shortening token and session lifetimes directly limits the window in which a previously issued access token or session cookie remains valid after an IdP-based role change; combined with step-up authentication (e.g., requiring a fresh TOTP or password for invoice approval), it forces a new authorization decision at the exact moment of a high-risk action. This aligns with the principle of least privilege because stale JWT claims or cached roles expire quickly, and sensitive operations trigger an additional proof of identity, reducing the likelihood of an unauthorized approval.
- ✗
Increase password complexity but keep session duration unchanged.
Why it's wrong here
Increasing password complexity only strengthens the initial authentication factor (e.g., resistance to brute-force or credential stuffing) but does not invalidate an already-issued session token or alter the cached role claims that the finance app uses for authorization. Since the user's IdP role has changed, the existing session remains valid with the old role until its original expiry, so the stale-authentication problem persists completely unaffected by a stronger password policy.
- ✓
Use current IdP group claims for authorization instead of cached local roles.
Why this is correct
Using current group claims ties authorization to the latest identity data. That means role changes in the IdP are reflected faster, rather than waiting for a local cache to expire or a manual refresh to happen.
- ✗
Disable SSO and email one-time passwords for every login.
Why it's wrong here
Disabling SSO and relying on email one-time passwords (OTPs) fragments identity management by removing the centralized IdP as the authoritative source of group and role attributes; email OTPs are a second-factor authentication method, not an authorization mechanism, so they never synchronize role changes in real time. This approach also breaks the federated trust that allows the app to query current claims, forcing each login to establish a separate local session and leaving stale role data cached in the application itself.
- ✗
Keep long-lived sessions to reduce help desk tickets.
Why it's wrong here
Keeping long-lived sessions, such as setting the access-token lifetime to hours or days and refreshing tokens indefinitely, deliberately enlarges the time window during which a terminated or role-downgraded user can continue operating with old authorization data. While reducing help-desk friction is desirable, this convenience directly conflicts with security for financial operations, as a session that persists overnight or longer will almost certainly contain stale IdP role claims and remains vulnerable to theft for a much longer period.
Go deeper
Related to this question
Learn chapter
Authentication Methods
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.