SY0-701 General Security Concepts Practice Question
Exhibit
IAM review notes: - HR updates job changes in the HR system - SaaS apps maintain separate local accounts - Deprovisioning is manual and often delayed - Users keep permissions from their previous role
After employees transfer departments, they keep access to old SaaS applications because app-specific accounts are removed only after a manual cleanup ticket. Which two changes best close the lifecycle gap? Select two.
⚠ Common exam trap
A common mix-up: candidates confuse password policies (Option E) with account lifecycle management, failing to recognize that frequent password changes do not remove orphaned accounts or close the provisioning gap.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use automated provisioning and deprovisioning tied to HR events through SCIM or an equivalent interface.
Automating provisioning and deprovisioning via SCIM (System for Cross-domain Identity Management) ties account lifecycle directly to HR events (e.g., termination, transfer). This eliminates the manual cleanup ticket gap by instantly removing or modifying access when an employee changes departments, ensuring no stale SaaS accounts remain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use automated provisioning and deprovisioning tied to HR events through SCIM or an equivalent interface.
Why this is correct
Automated provisioning systems use SCIM, an IETF-standardized RESTful API, to exchange identity lifecycle events between the IdP and service providers. When HR records a role change or termination, a workflow engine dynamically updates or disables accounts across all connected applications, eliminating the delay of human intervention. This enforces least privilege and reduces the risk that a lateral mover retains stale entitlements, because access is revoked in near-real-time to match the employee's current business need.
- ✗
Keep app accounts manually managed so each app owner can decide independently.
Why it's wrong here
Manual administration delegates deprovisioning to each application owner, but these owners rarely receive timely or complete HR status changes. When an employee transfers, their accounts in applications outside the owner's purview are easily forgotten or incorrectly kept, since the owner lacks a unified view. This fragmented approach produces a siloed, inconsistent lifecycle, with some apps revoked and others still active, and it fails to scale and lacks proper auditability.
- ✓
Map entitlements to IdP groups or roles based on job function.
Why this is correct
By mapping job-function-based entitlements to IdP groups or roles, you establish a single authoritative source for access rights. When an employee changes departments, an administrator simply updates their group or role assignments in the IdP; connected SaaS and on-prem systems that trust IdP assertions automatically grant or revoke permissions via SAML/OIDC. This approach supports role-based access control (RBAC), reduces administrative toil, and helps prevent overlapping or conflicting entitlements that result from individually assigned permissions.
- ✗
Share a generic help desk password for quick access restoration.
Why it's wrong here
Sharing a generic help desk password for quick restoration creates a permanent backdoor into every application. Because multiple people authenticate with the same credentials, the system cannot attribute actions to an individual user, breaking non-repudiation and auditing, and an already privileged user could use it to escalate further. Moreover, it fails to solve the underlying lifecycle problem—it simply adds an uncontrolled, high-risk lateral movement path and undoes any benefit from automated provisioning.
- ✗
Require password changes every 30 days for all users.
Why it's wrong here
Requiring password changes every 30 days only refreshes the authentication secret; it does not alter the user's authorization or application entitlements. An employee who transferred to another department can still access old team resources as long as their account and memberships remain active. Frequent password rotation can even reduce security by prompting users to choose predictable or reused passwords, and it distracts administrators from the real issue of re-certifying who has access to what.
Go deeper
Related to this question
Learn chapter
Access Control Models (DAC, MAC, RBAC)
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
Provisioning
Provisioning is the process of setting up and configuring IT resources, such as user accounts, devices, or network services, so they are ready for use.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.