SY0-701 Security Architecture Practice Question
Employees sign in once to the company portal and then can access email, the ticketing system, and the HR site without logging in again. What is this called?
⚠ Common exam trap
Many exam-takers confuse single sign-on with tokenization, because both involve 'tokens,' but tokenization is a data protection method for sensitive data, not an authentication mechanism for accessing multiple applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Single sign-on
Single sign-on (SSO) allows a user to authenticate once and gain access to multiple applications or systems without re-entering credentials. In this scenario, the company portal acts as the identity provider (IdP), and after initial authentication, it issues a token (e.g., SAML assertion or Kerberos ticket) that is accepted by the email, ticketing, and HR systems as proof of identity. This eliminates the need for repeated logins across these services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Single sign-on
Why this is correct
SSO centralizes authentication: the user authenticates once to an identity provider (IdP), which then issues a signed token or assertion (e.g., via SAML 2.0 or OpenID Connect) that multiple service providers trust. Because the IdP establishes a persistent session, subsequent portal resources or integrated applications accept the established trust without prompting for credentials again. This is exactly the behavior described: one initial login grants access across the company's integrated services.
- ✗
Port forwarding
Why it's wrong here
Port forwarding manipulates traffic at the network layer by mapping an external IP/port combination to an internal host and port, typically to expose a service inside a private network. It changes where packets are delivered, not how a user is authenticated or whether a session is shared across applications. Therefore it cannot produce the described 'one login, many apps' experience; it only affects packet routing.
- ✗
Tokenization
Why it's wrong here
Tokenization protects data by replacing sensitive values, such as payment card numbers, with a token that has no meaningful relationship to the original value and can only be reversed by a secure token vault. In SSO, the 'token' in SAML/OIDC is an authentication assertion that proves identity, but tokenization itself does not perform authentication or manage sessions. Thus tokenization reduces data exposure, but it does not let a user sign in once and reach multiple portal services.
- ✗
Network address translation
Why it's wrong here
Network address translation rewrites source or destination IP addresses as packets cross a router or firewall boundary, allowing many private hosts to share a single public IP address or hiding internal topology. It operates entirely at layers 3/4 and maintains a state table for connection mapping, with no knowledge of user identities, credentials, or application-level sessions. As a result, NAT has no bearing on whether a single login grants access across multiple applications.
Go deeper
Related to this question
Learn chapter
Cloud Access Security Broker (CASB)
Key term
SSO
Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications or systems with one set of login credentials.
Key term
Kerberos
Kerberos is a network authentication protocol that uses tickets and symmetric-key cryptography to verify the identity of users and services in a secure, non-repudiable way.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.