SY0-701 Security Architecture Practice Question
An HR system marks employees as hired, transferred, or terminated. The security team wants those changes to create, update, or disable accounts in multiple SaaS apps automatically after the user authenticates through the company identity provider. Which capability should be added?
⚠ Common exam trap
Many exam-takers confuse SAML federation (which only handles authentication) with full identity lifecycle management, leading them to pick option A, but the question explicitly requires automated account creation, update, and disablement—a capability only SCIM provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SCIM provisioning integrated with the SSO platform.
SCIM (System for Cross-domain Identity Management) is the correct choice because it provides a standardized protocol for automating the creation, update, and deletion of user accounts across multiple SaaS applications. When integrated with an SSO platform (like SAML), SCIM handles the lifecycle events (hire, transfer, terminate) by sending RESTful API calls to each SaaS app, ensuring accounts are created, updated, or disabled without manual intervention. SAML alone only handles authentication, not account provisioning, making SCIM essential for the described automation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SAML federation alone, with no additional account lifecycle automation.
Why it's wrong here
SAML federation only handles authentication and single sign-on; it does not automatically create, update, or disable accounts based on HR status changes. Without SCIM or custom webhooks, a terminated employee's account may remain active, especially for apps relying on local accounts. Therefore SAML alone leaves a gap in the identity lifecycle.
- ✗
Password synchronization between every application.
Why it's wrong here
Synchronizing passwords merely replicates the same credential across every application; it does not address account creation, status changes, or revocation. If an employee is terminated, the password might change, but the underlying accounts and their entitlements are not consistently disabled. This approach also increases credential exposure and lacks a single authoritative lifecycle source.
- ✓
SCIM provisioning integrated with the SSO platform.
Why this is correct
SCIM provisioning integrated with the SSO platform provides a standard REST-based API for automatically creating, updating, and disabling user accounts when HR marks employees as hired, transferred, or terminated. The HR system becomes the authoritative source, and the SSO platform propagates those lifecycle events to all connected applications in near real time. This enables centralized, auditable, and consistent identity lifecycle management across SaaS apps.
- ✗
Local administrator groups on each SaaS application.
Why it's wrong here
Managing local administrator groups in each SaaS application is a manual, per-app administrative task that is not tied to HR events. It does not scale, and it cannot ensure that a terminated employee's access is removed promptly or consistently across the application portfolio. There is no central governance or automated reconciliation, leaving orphaned accounts and stale entitlements.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
SAML
Security Assertion Markup Language (SAML) is an open standard that allows one system to securely tell another system that a user is who they say they are, without sharing the user's password.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.