SY0-701 Security Architecture Practice Question
Exhibit
Identity integration status: - Corporate IdP SAML SSO: Enabled - SaaS local accounts: Still manually managed - HR termination event: User disabled in the IdP - SaaS access after termination: Still active until help desk removes account Requirement: access changes must flow to the app within minutes without manual ticket handling.
Based on the exhibit, which capability should be added so the SaaS app automatically creates, updates, and disables user accounts as directory changes occur?
⚠ Common exam trap
A common mix-up: candidates confuse authentication mechanisms (like MFA) or password policies with identity lifecycle management, failing to recognize that SCIM is the specific protocol designed for automated provisioning and deprovisioning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add SCIM provisioning between the directory and the SaaS application.
SCIM (System for Cross-domain Identity Management) is the standard protocol designed to automate user provisioning and deprovisioning between an identity provider (like a directory) and a service provider (like a SaaS app). By adding SCIM provisioning, the SaaS app can automatically create, update, and disable user accounts in response to changes in the directory, eliminating the need for manual account management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require MFA on the SaaS login page and leave account provisioning manual.
Why it's wrong here
MFA is an authentication control that verifies identity at login, but it does nothing to manage the account lifecycle across the directory and SaaS app. It neither creates nor deactivates accounts, nor does it propagate directory changes to the SaaS application, so manual provisioning remains slow, error-prone, and insecure. A departed user's account can stay active indefinitely, and MFA only guards who can sign in—with a valid account. Thus, MFA does not address the requirement to quickly synchronize lifecycle events.
- ✓
Add SCIM provisioning between the directory and the SaaS application.
Why this is correct
SCIM (System for Cross-domain Identity Management) is a RESTful API standard that automatically exchanges user identity attributes between an identity provider and cloud apps. When an admin changes a user's status in the directory, SCIM pushes that event to the SaaS application, creating, updating, or deactivating the account in near real time. This eliminates the window during which terminated employees retain access and removes the need for manual provisioning. It directly satisfies the requirement for automated identity lifecycle synchronization.
- ✗
Change the password rotation interval to every 30 days for all users.
Why it's wrong here
Password rotation only changes the authentication secret; it leaves the account enabled and does not alter its lifecycle state. Rotating passwords every 30 days does not disable or remove accounts for former employees, nor does it push directory changes to the SaaS app. Additionally, frequent rotation can increase risk by encouraging weak or reused passwords, and it fails to address orphaned accounts. Therefore, this is a credential hygiene measure, not a lifecycle provisioning solution.
- ✗
Store credentials in a shared spreadsheet so the help desk can disable access faster.
Why it's wrong here
Storing credentials in a shared spreadsheet leaks sensitive secrets to anyone with file access, violating least privilege and creating a massive attack surface. Even with a spreadsheet, the help desk must manually locate and disable each account, which is no faster and can be missed, leaving access open. Spreadsheets lack versioning, audit trails, and automated integration with the directory, so they cannot synchronize lifecycle events. This is insecure and still requires the manual intervention that SCIM eliminates.
Go deeper
Related to this question
Learn chapter
Unified Threat Management (UTM)
Key term
Provisioning
Provisioning is the process of setting up and configuring IT resources, such as user accounts, devices, or network services, so they are ready for use.
Key term
Deprovisioning
Deprovisioning is the process of removing a user's access to systems and data when they no longer need it, typically when they leave an organization or change roles.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.