SY0-701 Security Architecture Practice Question
Employees need to sign in once to the corporate portal and then access email and the HR app without entering credentials again. Which two technologies make this possible in a secure design? Select two.
⚠ Common exam trap
CompTIA often tests the distinction between SSO and federation, where candidates mistakenly think SSO alone is sufficient for cross-domain access, but federation is required when the applications are managed by different identity domains or external providers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Single sign-on (SSO).
Single sign-on (SSO) allows a user to authenticate once and then access multiple applications (email, HR app) without re-entering credentials. This is achieved by the identity provider (IdP) issuing a token (e.g., SAML assertion, OIDC ID token) that is trusted by the service providers. SSO reduces password fatigue and centralizes authentication, but must be paired with federation to securely share identity across different domains or applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Single sign-on (SSO).
Why this is correct
Single sign-on (SSO) is the correct mechanism because it permits a user to authenticate once to a central identity provider and then access multiple trusted applications without being prompted for credentials again. The authentication produces a session or token that is presented to each service, enabling seamless navigation through the corporate portal. This reduces password fatigue, centralizes identity governance, and allows administrators to enforce consistent authentication policies across all connected applications.
- ✓
Federation between the identity provider and the other applications.
Why this is correct
Federation between the identity provider and the other applications is correct because it establishes a trust relationship that allows the authentication decision made by one system to be accepted by other systems. Standards such as SAML, OpenID Connect, and WS-Fed carry signed assertions or tokens across organizational boundaries, so the corporate portal can authenticate the user and the other applications can rely on that proof. This is what makes cross-domain SSO possible when the applications are not part of the same authentication domain.
- ✗
Network address translation (NAT).
Why it's wrong here
Network address translation (NAT) is a data-plane function that rewrites source or destination IP addresses as packets traverse a router or firewall, commonly to map private RFC 1918 addresses to public addresses. It operates at the network layer and has no concept of user identity or authentication sessions. A NAT device can forward traffic for many users behind a single public IP, but it cannot grant access to applications or allow a user to log in once and reuse that login elsewhere.
- ✗
Port address translation (PAT).
Why it's wrong here
Port address translation (PAT), a specific form of NAT often called NAT overload, multiplexes many internal hosts onto a single public IP address by assigning a unique transport-layer port number to each flow. While PAT distinguishes connections by TCP or UDP port, it is still purely a network-layer address translation mechanism. It provides zero authentication functionality and cannot store or relay user credentials, so it is unrelated to achieving one sign-on across applications.
- ✗
A hardened BIOS password on each workstation.
Why it's wrong here
A hardened BIOS password adds a firmware-level pre-boot authentication step that prevents unauthorized users from changing boot settings or starting the operating system. However, it only protects the local device's firmware and does not interact with the corporate portal or any external applications. Even if every workstation has a BIOS password, a user would still be required to enter separate credentials for each service, so it does not enable a single sign-on experience.
Go deeper
Related to this question
Learn chapter
Secure Network Design Principles
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
SAML
Security Assertion Markup Language (SAML) is an open standard that allows one system to securely tell another system that a user is who they say they are, without sharing the user's password.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization wants employees to sign in once and then access several SaaS applications without repeated logins. Which two technologies make this possible? Select two.
easy- ✓ A.Single sign-on
- ✓ B.Identity federation
- C.Network address translation
- D.Port forwarding
- E.Full-disk encryption
Why A: Single sign-on (SSO) allows a user to authenticate once and then access multiple applications without re-entering credentials. Identity federation extends this by establishing trust relationships between different organizations or identity domains, so that a single authentication event can be accepted by multiple SaaS applications. SSO provides the user session and token handling, while federation provides the trust framework (e.g., SAML, OIDC) that lets each application accept the SSO token. Together, they enable seamless access to multiple SaaS apps after a single sign-in.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.