SY0-701 General Security Concepts Practice Question
Employees authenticate once to a corporate portal and then open the help desk, payroll, and documentation apps without logging in again. The apps rely on tokens from the company's identity provider instead of storing separate passwords. What is being implemented?
⚠ Common exam trap
Many candidates confuse 'federated single sign-on' with 'password synchronization' (Option A), because both reduce the number of logins, but federation uses tokens and trust relationships, not shared or synced passwords.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Federated single sign-on using the corporate identity provider.
The scenario describes single sign-on (SSO) where the corporate identity provider (IdP) issues tokens (e.g., SAML assertions, OIDC ID tokens) after initial authentication. The help desk, payroll, and documentation apps are configured as service providers that trust the IdP, so they accept the token instead of requiring separate credentials. This is federated SSO because the apps rely on a central identity provider rather than sharing password databases or synchronizing passwords.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password synchronization between every application in the suite.
Why it's wrong here
Password synchronization replicates the same credential across every application's user store. Even after the user signs into the corporate portal once, each application can still prompt for its own login because password matching does not establish a shared trust or session between systems. This also gives attackers the same usable credential in many places and forces risky bulk password changes whenever one copy is compromised.
- ✓
Federated single sign-on using the corporate identity provider.
Why this is correct
Correct. Federated SSO lets the identity provider authenticate the user once and then issue tokens or assertions that other trusted applications accept. This improves usability while reducing password sprawl and lowering the number of credentials stored by individual services. It is a standard enterprise pattern for accessing multiple apps with one login session.
- ✗
Shared guest accounts for all employees on the portal.
Why it's wrong here
A shared guest account removes all individual accountability because every employee authenticates with the same username and password. Security teams cannot tie portal activity back to a particular user, cannot revoke access for a single departing employee, and cannot enforce least privilege on common resources, which violates audit and compliance requirements. Shared identities are usable by any employee, so insider-threat detection and incident response become nearly impossible.
- ✗
Split tunneling through a VPN to speed up application access.
Why it's wrong here
Split tunneling is a VPN routing mode that sends only corporate-destination traffic through the encrypted tunnel and lets other traffic use the local internet connection. While this can reduce latency, it does nothing to tell the applications about the user's authentication status; each application still requires its own credential validation. In fact, directing selected traffic around the VPN can bypass required security inspection, but either way VPN behavior is unrelated to establishing a federated identity relationship.
Go deeper
Related to this question
Learn chapter
Authentication Methods
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
SSO
Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications or systems with one set of login credentials.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.