SY0-701 Question 317
Single answer4.5 Given a scenario, modify enterprise capabilities to enhance security.A company recently acquired a smaller business and needs to give the new employees access to several internal SaaS applications quickly. The security team discovers that the acquired company used weak password practices, and leadership wants to reduce account compromise risk without creating a large administrative burden for the help desk. Which action would BEST modify the enterprise environment to improve security while supporting rapid onboarding?
- A
Integrate the acquired users into the company identity provider and enforce SSO with MFA for all SaaS access
- B
Create local accounts in each SaaS platform and require users to change their passwords every 30 days
- C
Allow the acquired company to continue using its existing directory service and establish a trust later
- D
Deploy a password vault for the help desk so staff can manage user passwords centrally across all SaaS applications
Show answer and explanation
Correct answer: A
Explanation
The best answer is to integrate the acquired users into the enterprise identity provider and enforce SSO with MFA. In Security+ objectives related to modifying enterprise capabilities to enhance security, identity and access management improvements are a key control area. Centralized identity providers support federation, policy enforcement, lifecycle management, logging, and faster provisioning/deprovisioning across cloud and on-premises resources. MFA significantly reduces the likelihood of compromise from weak or reused passwords, and SSO reduces password sprawl across multiple services. This approach aligns with widely accepted best practices from sources such as NIST SP 800-63 for digital identity guidance and general zero trust principles emphasizing strong, centrally managed authentication and authorization.
- A. Correct.
Correct. Integrating users into the organization’s identity provider and requiring single sign-on (SSO) with multifactor authentication (MFA) centralizes authentication, improves visibility, simplifies provisioning/deprovisioning, and reduces the risk created by weak inherited password practices. This is a practical enterprise capability modification because it enhances identity and access management while also supporting fast onboarding to multiple applications.
- B. Incorrect.
Incorrect. Creating separate local accounts in each SaaS application increases administrative overhead, weakens centralized control, and makes consistent enforcement of security policies more difficult. Frequent password changes alone do not address the broader identity management issue and can lead to poor user behavior such as predictable password patterns or password reuse.
- C. Incorrect.
Incorrect. Leaving the acquired company on its legacy directory delays security standardization and allows weaker authentication practices to remain in place. Although directory trusts can be useful in some environments, this option does not best reduce account compromise risk quickly or streamline onboarding into multiple SaaS platforms.
- D. Incorrect.
Incorrect. A password vault can help protect privileged or shared credentials, but it is not the best solution for onboarding a newly acquired workforce into multiple SaaS applications. Help desk-controlled password management does not solve the need for centralized identity, user lifecycle management, or strong user authentication such as MFA.