SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create separate local usernames and passwords in each application for every employee.

  Why it's wrong here

  Creating separate local usernames and passwords for each SaaS app fragments identity management. Employees must remember multiple credentials, which encourages password reuse and weakens security. It also makes offboarding a painfully slow multi-system chore, because IT has to manually delete or disable each account individually instead of relying on a single authoritative identity source.

• ✓

  Use federation so the SaaS apps trust the company's identity provider.

  Why this is correct

  Federation lets external SaaS applications delegate authentication to the company's identity provider (IdP) using standards such as SAML 2.0 or OpenID Connect. This centralizes login, MFA, and conditional access policies in one place, eliminates the need for separate per-app credential stores, and ensures that when an employee leaves, their access to all federated apps is immediately cut off at the IdP. It directly addresses the goal of reducing credential sprawl and enforcing consistent access control across the browser portal and mobile app.

• ✗

  Store passwords in a shared vault and let users retrieve them when needed.

  Why it's wrong here

  A shared password vault merely provides a storage location, so users still reuse the same weak passwords across applications, and the vault itself becomes a high-value target for attackers. It does not provide central identity governance or policy enforcement, and employees can still access the vault with their own credentials, meaning terminated users must be manually removed from the vault list. This approach increases exposure and does nothing to unify authentication or streamline offboarding.

• ✓

  Automate account provisioning and deprovisioning from HR changes with SCIM or an equivalent feed.

  Why this is correct

  Automating account provisioning and deprovisioning with SCIM synchronizes user accounts in SaaS apps with authoritative HR data. When an employee is hired or changes roles, SCIM automatically creates and updates their accounts; when they leave, accounts are deactivated promptly, reducing orphaned accounts and security risks. This directly speeds offboarding across all applications, including the browser portal and mobile app, while ensuring access is consistently managed without manual intervention.

• ✗

  Allow the mobile app to authenticate only from remembered devices, without central identity controls.

  Why it's wrong here

  Remembering devices only ties authentication to a physical device, not to a centralized identity, so the app essentially trusts that device without requiring corporate identity verification. This bypasses standard identity controls like MFA, SSO, and centralized session management, making it ineffective for offboarding—since a terminated employee's remembered device may continue to have access. It also provides no way to enforce policy centrally, so it is only a convenience layer, not an identity governance solution.

Go deeper

Related to this question