SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Require the provider to document logical tenant isolation and separate customer encryption keys.

  Why this is correct

  Logical tenant isolation helps prevent one tenant from reading or influencing another tenant’s data. Separate customer encryption keys further reduce cross-tenant risk because encrypted content is not protected by a single shared key set. Together, these requirements are useful when evaluating multi-tenant SaaS risk and selecting a provider with stronger separation controls.

• ✗

  Use a shared local administrator account for the app so offboarding is easier.

  Why it's wrong here

  A shared local administrator account provides no per-user attribution, so audit logs cannot tie actions to an individual administrator, and any password change must be coordinated across everyone who uses it. Offboarding a single employee is impossible without rotating the shared credential and notifying every remaining admin, which delays revocation and increases administrative overhead. Because local accounts are not connected to the corporate IdP, they also bypass federated authentication and SCIM-based deprovisioning, leaving a long-lived backdoor outside centralized control.

• ✗

  Allow anonymous public links as the default method for external collaboration.

  Why it's wrong here

  Anonymous public links disable authentication at the object level, meaning anyone with the URL can read, comment, or download the document without any identity check or MFA challenge. This default setting undermines tenant isolation by exposing content beyond the authorized user community and prevents the organization from enforcing data-loss-prevention or expiration policies on individual shares. In a multi-tenant SaaS, such links also bypass the audit trail, making it impossible to determine who accessed sensitive files or to revoke access quickly when a collaboration ends.

• ✓

  Integrate the SaaS with the corporate IdP using federation and SCIM lifecycle automation.

  Why this is correct

  Federation centralizes authentication and lets the company enforce MFA and access policies from the identity provider. SCIM automation supports fast, consistent account provisioning and deprovisioning, which is exactly what the offboarding requirement calls for. This combination reduces manual cleanup delays and helps ensure access is removed within minutes rather than days.

• ✗

  Rely on manual quarterly cleanup tickets to disable former employees.

  Why it's wrong here

  Quarterly cleanup tickets mean the former employee's accounts and sessions remain active for up to 90 days, which is far beyond the maximum tolerable access-revocation window required by most security policies. Manual review is error-prone and dependent on the timing of the ticket, so orphaned accounts can persist indefinitely if the ticket is missed or the owner's name is misspelled. Automated lifecycle management via SCIM and integration with the HR system is the security baseline, because it deactivates accounts in near real-time and eliminates the need for human follow-up.

Go deeper

Related to this question