SY0-701 Security Architecture Practice Question
A supplier portal is browser-based and used by external partner companies. Each partner already has its own identity provider. The portal must trust assertions from those IdPs and avoid creating separate local passwords for each partner. Which integration is best?
⚠ Common exam trap
Many exam-takers confuse LDAP synchronization (which replicates accounts) with federation (which avoids storing accounts), or mistakenly think NTLM can be extended across organizational boundaries, when in fact NTLM is a legacy challenge-response protocol limited to a single Windows domain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use SAML 2.0 federation with trust relationships to the partner identity providers.
SAML 2.0 federation is the correct choice because it enables the supplier portal to trust assertions from multiple external identity providers (IdPs) without creating local passwords. SAML uses XML-based tokens signed by the partner's IdP, allowing the portal to accept authentication claims via a trust relationship, which directly meets the requirement of avoiding separate local credentials for each partner.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use LDAP directory synchronization for all partner users.
Why it's wrong here
LDAP directory synchronization copies user objects from partner directories into the portal's own directory, creating duplicate identities that must be continuously updated. It does not provide a browser-based federation model because the portal still performs its own authentication against those replicated accounts. This introduces lifecycle delays and does not delegate authentication to partner identity providers.
- ✓
Use SAML 2.0 federation with trust relationships to the partner identity providers.
Why this is correct
SAML 2.0 federation establishes explicit trust relationships between the portal as a service provider and each partner identity provider through exchanged metadata and signing certificates. Users authenticate at their own IdP, which sends a digitally signed SAML assertion to the portal via browser redirects, enabling SSO without sharing passwords. This is the standard for cross-organization web single sign-on and directly satisfies the requirement for external partner browser access.
- ✗
Use NTLM pass-through authentication to each partner account.
Why it's wrong here
NTLM pass-through authentication is a challenge-response protocol tied to Windows domain credentials and requires the portal to either join the partner's domain or hold shared secrets. It is not a federation standard, cannot operate through browser redirects with external identity providers, and has known security vulnerabilities. Relying on it for partner access would force impractical Windows-centric infrastructure and expose weak authentication.
- ✗
Use PAP over TLS so the portal can collect partner passwords securely.
Why it's wrong here
PAP over TLS would transmit partner usernames and passwords to the portal for validation, requiring the portal to collect and compare credentials directly. This undermines federation by creating a centralized vault of external passwords, increasing breach impact and compliance burden. Additionally, PAP is not an SSO or federation protocol; it simply authenticates a network connection and gives partners no independent identity control.
Go deeper
Related to this question
Learn chapter
Cloud IAM and Identity Architecture
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Federation
Federation is a system that lets you use one set of login credentials (like your work email and password) to access resources across different organizations or services without needing separate accounts for each one.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.