SY0-701 Security Architecture Practice Question
A manufacturer needs to grant a partner company access to a procurement portal. Partner users should authenticate with their own identity provider, and the manufacturer does not want to create local passwords for each partner employee. Which design best supports this?
⚠ Common exam trap
Watch out — candidates often confuse NTLM pass-through authentication (Option C) as a viable cross-org solution, not realizing it requires a direct Active Directory trust and cannot work without establishing a federation relationship, whereas federation with SAML/OIDC is the correct modern approach for external identity provider integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish federation with SAML or OIDC and support just-in-time provisioning for partner users.
Federation with SAML or OIDC allows the partner company to use its own identity provider for authentication, eliminating the need for local passwords. Just-in-time provisioning automatically creates user accounts in the manufacturer's procurement portal upon first successful authentication, ensuring access is granted without manual account management. This design supports secure cross-organization trust without sharing credentials or maintaining duplicate user stores.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create local accounts for every partner user and reset passwords manually when staff changes occur.
Why it's wrong here
Manually creating local accounts for every partner user is operationally unsustainable and a security liability. The manufacturer becomes responsible for the full identity lifecycle, including password resets, lockouts, and disabling accounts when staff leave, which invites orphaned accounts and credential sprawl. It also fails to support partner-owned identity assertions, so there is no trust-based verification that a user is still authorized by the partner.
- ✗
Share one VPN credential with the partner organization and let them manage access internally.
Why it's wrong here
Sharing a single VPN credential forfeits individual accountability because all partner users appear as one identity in logs, making it impossible to attribute actions to a specific person. It also violates the principle of least privilege: each user should have a unique identity so access can be individually revoked, audited, and tied to policies. The partner cannot securely manage its own internal access this way, and any credential leak or staff departure would force a full credential rotation across the entire partner organization.
- ✗
Use NTLM pass-through authentication to avoid setting up trust relationships.
Why it's wrong here
NTLM pass-through authentication is a legacy challenge-response protocol that cannot establish modern federation or support SSO with external identity providers. It requires the partner's password hash to be exposed to the manufacturer's domain controller, which expands the attack surface and is inappropriate for cross-organization trust. NTLM also lacks modern standards like SAML or OIDC assertions, so it does not enable just-in-time provisioning or attribute-based access control for partner users.
- ✓
Establish federation with SAML or OIDC and support just-in-time provisioning for partner users.
Why this is correct
Federation with SAML or OIDC is the correct approach because it lets partner users authenticate against their own identity provider while the manufacturer's portal trusts the signed assertion and creates a local account on demand via just-in-time provisioning. This decouples identity lifecycle management from the manufacturer, reduces credential storage, and supports fine-grained authorization based on claims. It also enables seamless SSO, automatic account deactivation when the partner revokes access, and strong compliance through per-user auditable assertions.
Go deeper
Related to this question
Learn chapter
Secure Network Design Principles
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
Provisioning
Provisioning is the process of setting up and configuring IT resources, such as user accounts, devices, or network services, so they are ready for use.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A manufacturer wants to give partner-company users access to a procurement portal. The partner wants to authenticate its own users, and the manufacturer does not want to create separate local passwords for them. What is the best solution?
medium- A.Create shared portal accounts and distribute credentials to the partner's staff.
- ✓ B.Federate access with the partner's identity provider and map claims or attributes to portal roles.
- C.Issue one VPN account for the partner organization and let them share it internally.
- D.Require each partner user to create a password directly in the procurement portal.
Why B: Federation with the partner's identity provider (IdP) using standards like SAML 2.0 or OIDC allows the partner to authenticate their own users while the manufacturer's portal trusts those assertions. Claims or attributes from the IdP (e.g., group membership) are mapped to portal roles, eliminating the need for local passwords and enabling single sign-on (SSO). This is the best solution because it maintains security boundaries and offloads authentication management to the partner.
Variation 2. A manufacturer wants partner-company users to access a procurement portal. The manufacturer does not want to create separate local accounts, and the partners want to authenticate their own users with existing corporate identities. Which two capabilities should be implemented? Select two.
medium- A.Create a separate local account for every partner employee and store the passwords internally.
- ✓ B.Trust the partner identity providers through federation and accept their assertions.
- C.Use a shared generic partner login for each company to simplify support.
- ✓ D.Map partner roles or groups to application permissions after authentication.
- E.Require partners to email screenshots of their credentials to request access.
Why B: Federation allows the manufacturer to trust identity assertions from the partners' own identity providers (IdPs) using standards like SAML 2.0 or OIDC. This eliminates the need for local accounts while enabling partners to authenticate with their existing corporate identities. However, authentication alone does not determine what users are allowed to do; after successful federation, the application must map partner roles or groups to application permissions. Both federation (authentication) and role mapping (authorization) are required to meet the full access control needs.
Variation 3. A manufacturer wants partner-company users to access a procurement portal using their own company identities. The manufacturer does not want to create local accounts for each partner user, but it still needs to control what those users can do in the portal. Which approach should be used?
medium- A.Create one shared partner account for each external company and reuse the same password.
- ✓ B.Use federated identity with role mapping so the portal trusts each partner’s identity provider.
- C.Synchronize every partner user into the manufacturer’s directory and require a separate password change.
- D.Store partner passwords in the portal database and use password reset emails for access control.
Why B: Federated identity with role mapping allows the manufacturer to trust authentication performed by each partner's own identity provider (IdP) using standards like SAML 2.0 or OpenID Connect. This eliminates the need for local accounts while enabling fine-grained access control through roles or attributes passed in the assertion, ensuring partners can only perform authorized actions in the portal.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.