SY0-701 Security Architecture Practice Question
A SaaS vendor supports both browser access and a mobile app. The company wants employees to sign in with corporate credentials, avoid separate passwords for each app, and use token-based authentication that works well with modern APIs. Which integration should the architect choose?
⚠ Common exam trap
Many exam-takers confuse SAML (which is browser-based) with OpenID Connect, assuming SAML can handle mobile apps and API tokens just as easily, but SAML lacks native support for token-based API authentication without complex extensions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OpenID Connect federation with the corporate identity provider.
OpenID Connect (OIDC) is the correct choice because it is an identity layer built on top of OAuth 2.0, designed for token-based authentication that works seamlessly with modern REST APIs and mobile apps. It allows employees to sign in with corporate credentials via the corporate identity provider (IdP), eliminates separate app passwords, and issues ID tokens (JWT) and access tokens that the SaaS vendor can validate without browser redirects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SAML federation to the SaaS vendor using browser assertions only.
Why it's wrong here
SAML federation relies on browser redirects and XML-based assertions, which work well for traditional web single sign-on but are poorly suited to native mobile apps and REST APIs. Because SAML assumes a browser user agent to relay the assertion, a mobile app would need a webview or custom bridge to handle authentication, adding complexity and friction. This makes it the wrong choice when the SaaS vendor must support both browser access and a mobile app with modern token-based flows.
- ✓
OpenID Connect federation with the corporate identity provider.
Why this is correct
OpenID Connect (OIDC) is an identity layer built on OAuth 2.0 that returns a signed JWT ID token and an access token, enabling both user authentication and API authorization. It works natively across browsers via authorization code flow and mobile apps via PKCE, so it cleanly covers the SaaS vendor's dual access modes. Since OIDC federates with a corporate identity provider, users get seamless SSO while the mobile app securely obtains tokens without exposing passwords.
- ✗
LDAP bind authentication directly against each SaaS application.
Why it's wrong here
LDAP bind authentication requires each SaaS application to communicate directly with the corporate LDAP directory and validate credentials itself. This not only creates a separate authentication path for every application, but also forces the SaaS vendor to handle plaintext or hashed passwords over the network, violating modern zero-trust principles. It provides no federation or SSO, no token lifecycle management, and fails to align with cloud-native, API-driven SaaS architecture.
- ✗
Kerberos tickets issued directly by the SaaS vendor.
Why it's wrong here
Kerberos authentication depends on a Key Distribution Center (KDC), shared secret keys, and time-sensitive tickets, all designed for an internal Active Directory domain environment. A SaaS vendor issuing its own Kerberos tickets would have no trust relationship with the corporate domain, making the tickets meaningless for authenticating external users. This approach is fundamentally incompatible with internet-facing SaaS and does not address mobile app authentication, so it is not a viable federation method.
Go deeper
Related to this question
Learn chapter
Data Protection and Encryption at Rest
Key term
OpenID Connect
OpenID Connect is an identity layer on top of OAuth 2.0 that allows applications to verify a user's identity and obtain basic profile information in a standardized way.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.