Employees use several SaaS applications, and the security team wants one corporate login, MFA for unmanaged devices, and centralized account provisioning. Which architecture should be used?

Create separate usernames and passwords for each SaaS application.

This increases password sprawl and makes centralized provisioning and access enforcement harder to manage.

Share one generic account for the team so access is easier to audit.

Shared accounts reduce accountability and create major problems for auditing and access revocation.

Put all users on a VPN and let each SaaS application trust the internal network automatically.

Network location alone is not a strong identity control and does not centralize authentication or MFA requirements.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Use federated single sign-on with the corporate identity provider and conditional access policies. — Federated single sign-on with the corporate identity provider is the best fit because it centralizes authentication and account lifecycle management across SaaS applications. Conditional access then lets the organization enforce stronger requirements, such as MFA on unmanaged devices or from higher-risk locations. This approach improves usability while also reducing password sprawl and giving the security team a single place to manage trust decisions. Why others are wrong: A creates more accounts to manage and weakens control consistency across services. C is a poor security practice because shared credentials eliminate user accountability. D relies on network presence rather than identity assurance, so it does not meet the requirement for centralized provisioning, SSO, or device-aware MFA decisions.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.