SY0-701 Security Architecture Practice Question
Employees sign in once to the corporate portal and then open email, the ticketing system, and an HR application without entering credentials again. The external SaaS providers should trust the company's identity provider rather than creating separate user databases. What architecture is being used?
⚠ Common exam trap
A common mix-up: candidates confuse 'single sign-on' with 'synchronized passwords' (Option A) or think that any centralized authentication mechanism (like 802.1X) can replace federated identity for external SaaS trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Federation with single sign-on using the corporate identity provider
This scenario describes federation with single sign-on (SSO), where the corporate identity provider (IdP) authenticates the user once and issues a security token (e.g., SAML assertion or OIDC token) that external SaaS providers trust. This eliminates the need for separate user databases in each application and allows seamless access across multiple services without re-entering credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Local authentication on each application with synchronized passwords
Why it's wrong here
Local authentication with synchronized passwords leaves each application as its own identity authority: although user secrets are copied to every app's directory, there is no shared trust relationship or single authentication ceremony. Each app independently validates credentials, so a user may still be prompted to log in multiple times, and credential synchronization expands the attack surface by creating multiple password stores that must all be protected and kept in sync.
- ✓
Federation with single sign-on using the corporate identity provider
Why this is correct
Federation allows one organization to trust authentication performed by another identity provider. When combined with single sign-on, the user signs in once and then accesses multiple applications without repeated logins. This is exactly what the scenario describes, especially across separate SaaS services.
- ✗
Network access control using 802.1X authentication
Why it's wrong here
Network access control can verify device or user identity at the network edge, but it does not provide the application-level trust relationship described here. It also does not by itself create SSO across SaaS apps.
- ✗
Role-based access control on the file server
Why it's wrong here
Role-based access control on the file server defines what an authenticated user may do with files, but it presumes an identity has already been established and does not create inter-application trust. The scenario asks how one corporate sign-in is accepted by multiple applications; RBAC only manages authorization decisions after authentication, so it cannot enable SSO or bridge identity across SaaS services.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
SAML
Security Assertion Markup Language (SAML) is an open standard that allows one system to securely tell another system that a user is who they say they are, without sharing the user's password.
Key term
Federation
Federation is a system that lets you use one set of login credentials (like your work email and password) to access resources across different organizations or services without needing separate accounts for each one.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.