Question 1,096 of 1,013
SY0-701 Security Architecture Practice Question
Exhibit
SaaS sign-in settings: - Local accounts: Enabled - SAML SSO: Disabled - SCIM provisioning: Disabled - Password synchronization: Disabled Requirement: users from the acquired subsidiary must use their existing corporate identities without separate SaaS passwords.
Based on the exhibit, which integration best lets the SaaS application trust the company's existing identity provider so users can sign in with their corporate credentials?
⚠ Common exam trap
Many exam-takers confuse password synchronization (a legacy or on-premises approach) with federation (SAML), thinking that syncing passwords achieves the same 'trust' without realizing it requires the SaaS app to handle credentials directly, which is less secure and not true federation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish SAML federation so the SaaS app trusts the corporate identity provider.
SAML (Security Assertion Markup Language) federation allows the SaaS application to trust the corporate identity provider (IdP) by exchanging signed XML assertions. This enables users to authenticate against their corporate credentials without the SaaS app ever storing or managing those credentials, providing single sign-on (SSO) across domains.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Establish SAML federation so the SaaS app trusts the corporate identity provider.
Why this is correct
SAML 2.0 federation establishes the SaaS application as a service provider that trusts the corporate identity provider (IdP). When a user attempts to access the SaaS app, the app redirects them to the IdP, which authenticates them against the corporate directory and issues a digitally signed XML assertion. The SaaS app verifies the signature and grants session access, so users never need a separate SaaS password and account provisioning can be centrally managed.
- ✗
Enable password synchronization so the SaaS app stores the same password as the directory.
Why it's wrong here
Password synchronization copies the corporate directory password into the SaaS application's own user store, but the SaaS app still performs local authentication rather than relying on an external identity provider. This reintroduces credential management within the SaaS app, so security policies like multi-factor authentication and account lockout must be enforced separately. It also expands the attack surface because a copy of every user's password now exists outside the directory, and it does not give the SaaS app a trust relationship with the identity provider.
- ✗
Create a shared local administrator account for all subsidiary users.
Why it's wrong here
A shared local administrator account for all subsidiary users provides no way to distinguish who performed a given action, destroying non-repudiation and making audit trails useless. It violates the principle of least privilege because every user gets identical elevated rights, and it does not involve the identity provider, so there is no centralized authentication or federated trust. This approach creates a serious security and compliance liability, not an integration.
- ✗
Configure MAC address filtering on company laptops to allow portal access.
Why it's wrong here
MAC address filtering controls which physical network adapters can reach the portal by checking the hardware address, not the identity of the person using the device. Because MAC addresses can be spoofed and do not carry any authentication factor, this mechanism verifies a device, not a user, and cannot replace SAML-based single sign-on. It also provides no session establishment or assertion exchange with the corporate identity provider.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.