SY0-701 Security Architecture Practice Question
Employees use several SaaS applications, and the security team wants one corporate login, MFA for unmanaged devices, and centralized account provisioning. Which architecture should be used?
⚠ Common exam trap
Candidates often confuse network-level controls (VPN) with identity-level controls (federation), assuming that a VPN provides the same authentication and authorization granularity as SSO with conditional access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use federated single sign-on with the corporate identity provider and conditional access policies.
Federated single sign-on (SSO) with a corporate identity provider (IdP) allows users to authenticate once using their corporate credentials and access multiple SaaS applications without separate logins. Conditional access policies can enforce MFA specifically for unmanaged devices, and centralized account provisioning (e.g., via SCIM) ensures accounts are created, updated, and deprovisioned from a single directory. This architecture meets all three requirements: single corporate login, MFA for unmanaged devices, and centralized provisioning.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create separate usernames and passwords for each SaaS application.
Why it's wrong here
Managing separate usernames and passwords for each SaaS application creates credential sprawl and fragmented identity silos. IT must manually provision, update, and deprovision accounts in every app, which consumes effort, leaves stale accounts behind, and expands the attack surface. Users are more likely to reuse weak passwords, and the organization cannot enforce a single, consistent MFA or conditional-access policy across all applications.
- ✓
Use federated single sign-on with the corporate identity provider and conditional access policies.
Why this is correct
Federated single sign-on with the corporate identity provider lets users authenticate once—typically with MFA—and receive a SAML or OIDC assertion that each SaaS application trusts. Conditional access policies evaluate real-time signals such as user risk, device compliance, or geolocation before issuing the token, enabling dynamic controls like blocking unmanaged devices or requiring step-up authentication. This approach centralizes identity lifecycle management and enforces uniform security policy across every connected application.
- ✗
Share one generic account for the team so access is easier to audit.
Why it's wrong here
A shared generic team account eliminates individual accountability because audit logs can only attribute actions to the shared account, not to a specific person. This makes forensic investigations, least-privilege enforcement, and access reviews impossible, and a single compromised password exposes the entire team. When one member leaves or the account must be revoked, access is disrupted for everyone, violating core identity and access management principles.
- ✗
Put all users on a VPN and let each SaaS application trust the internal network automatically.
Why it's wrong here
Relying on VPN connectivity and 'trusting the internal network' fails for SaaS because those applications run in external clouds and do not treat a VPN source IP as proof of a user's identity. Network location is a weak, spoofable signal that reveals nothing about who is making the request, and it does not enforce MFA or enable per-user conditional access. It also funnels all traffic through a central gateway, creating bottlenecks, and provides no automated provisioning, deprovisioning, or audit trail tied to individual identities.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.