SY0-701 Security Architecture Practice Question
Exhibit
Exhibit: - SaaS A uses local user accounts - SaaS B uses local user accounts - SaaS C supports SAML and automated provisioning - Help desk reports 120 password reset tickets per month - Former employees can remain active in two apps for up to 24 hours after termination Management wants one sign-in and faster deprovisioning.
Based on the exhibit, which identity architecture change best addresses the repeated password resets and delayed offboarding across the company's SaaS applications?
Exhibit: - SaaS A uses local user accounts - SaaS B uses local user accounts - SaaS C supports SAML and automated provisioning - Help desk reports 120 password reset tickets per month - Former employees can remain active in two apps for up to 24 hours after termination
Management wants one sign-in and faster deprovisioning.
⚠ Common exam trap
Test-takers frequently confuse network-layer controls (firewall, IP filtering) with identity-layer solutions, failing to recognize that only federated SSO with automated provisioning addresses both single sign-in and rapid deprovisioning across SaaS apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement federated SSO with the enterprise identity provider and automated provisioning for SaaS users.
Implementing federated SSO with the enterprise identity provider (IdP) centralizes authentication, allowing users to sign in once. Combined with automated provisioning (SCIM), it enables near-instant deprovisioning when an employee is terminated, eliminating the 24-hour delay and reducing password reset tickets by removing the need for local account management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement federated SSO with the enterprise identity provider and automated provisioning for SaaS users.
Why this is correct
This is the best answer because federation centralizes authentication, and automated provisioning improves lifecycle management. Users sign in once through the identity provider, reducing password fatigue and help desk resets. When accounts are created, modified, or removed centrally, access changes can reach supported applications much faster, which helps with offboarding and reduces orphaned access.
- ✗
Create one shared account for each application and store the passwords in a vault.
Why it's wrong here
Shared accounts make accountability worse and create a larger blast radius if credentials are exposed. A vault is useful for secrets management, but it does not solve individual identity, least privilege, or timely offboarding concerns.
- ✗
Keep local accounts in every SaaS app and reset passwords whenever staff change roles.
Why it's wrong here
Keeping local accounts in every SaaS app and resetting passwords whenever staff change roles preserves the exact identity sprawl shown in the exhibit: each application maintains its own independent credential and directory, so there is no central source of truth. Role changes trigger only reactive password resets rather than automated entitlement updates, meaning former permissions can linger long after a user's duties change. As the application portfolio grows, this manual, app-by-app approach multiplies administrative overhead, increases password fatigue, and makes consistent offboarding nearly impossible, which directly enables orphaned accounts. This is the opposite of a scalable identity architecture because lifecycle events such as join, move, and leave are not propagated automatically.
- ✗
Put the SaaS apps behind a network firewall and use source IP filtering instead of identity.
Why it's wrong here
Using a network firewall with source IP filtering instead of identity-based access does not address the actual security requirements of SaaS applications: it checks where a request comes from, not who is making it, so it cannot enforce least privilege, individual accountability, or MFA. IP addresses are frequently dynamic, spoofable, or shared through VPNs/NAT, and remote or mobile users may present legitimate but unpredictable source addresses, making this control both brittle and user-hostile. Additionally, IP filtering in no way addresses password resets, account lifecycle management, or offboarding, because it does not integrate with directory data or automate provisioning. In modern cloud and SaaS environments, network perimeter controls are a weak complement to identity federation, not a substitute for it.
Go deeper
Related to this question
Learn chapter
DMZ Architecture and Design
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Deprovisioning
Deprovisioning is the process of removing a user's access to systems and data when they no longer need it, typically when they leave an organization or change roles.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.