SY0-701 Security Architecture Practice Question
Exhibit
SaaS sign-in settings: - Local accounts: Enabled - SAML SSO: Disabled - SCIM provisioning: Disabled - Password synchronization: Disabled Requirement: users from the acquired subsidiary must use their existing corporate identities without separate SaaS passwords.
Based on the exhibit, which integration best lets the SaaS application trust the company's existing identity provider so users can sign in with their corporate credentials?
⚠ Common exam trap
Many exam-takers confuse password synchronization (a legacy or on-premises approach) with federation (SAML), thinking that syncing passwords achieves the same 'trust' without realizing it requires the SaaS app to handle credentials directly, which is less secure and not true federation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish SAML federation so the SaaS app trusts the corporate identity provider.
SAML (Security Assertion Markup Language) federation allows the SaaS application to trust the corporate identity provider (IdP) by exchanging signed XML assertions. This enables users to authenticate against their corporate credentials without the SaaS app ever storing or managing those credentials, providing single sign-on (SSO) across domains.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Establish SAML federation so the SaaS app trusts the corporate identity provider.
Why this is correct
SAML 2.0 federation establishes the SaaS application as a service provider that trusts the corporate identity provider (IdP). When a user attempts to access the SaaS app, the app redirects them to the IdP, which authenticates them against the corporate directory and issues a digitally signed XML assertion. The SaaS app verifies the signature and grants session access, so users never need a separate SaaS password and account provisioning can be centrally managed.
- ✗
Enable password synchronization so the SaaS app stores the same password as the directory.
Why it's wrong here
Password synchronization copies the corporate directory password into the SaaS application's own user store, but the SaaS app still performs local authentication rather than relying on an external identity provider. This reintroduces credential management within the SaaS app, so security policies like multi-factor authentication and account lockout must be enforced separately. It also expands the attack surface because a copy of every user's password now exists outside the directory, and it does not give the SaaS app a trust relationship with the identity provider.
- ✗
Create a shared local administrator account for all subsidiary users.
Why it's wrong here
A shared local administrator account for all subsidiary users provides no way to distinguish who performed a given action, destroying non-repudiation and making audit trails useless. It violates the principle of least privilege because every user gets identical elevated rights, and it does not involve the identity provider, so there is no centralized authentication or federated trust. This approach creates a serious security and compliance liability, not an integration.
- ✗
Configure MAC address filtering on company laptops to allow portal access.
Why it's wrong here
MAC address filtering controls which physical network adapters can reach the portal by checking the hardware address, not the identity of the person using the device. Because MAC addresses can be spoofed and do not carry any authentication factor, this mechanism verifies a device, not a user, and cannot replace SAML-based single sign-on. It also provides no session establishment or assertion exchange with the corporate identity provider.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
SAML
Security Assertion Markup Language (SAML) is an open standard that allows one system to securely tell another system that a user is who they say they are, without sharing the user's password.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.