SY0-701 Question 350
Single answerFederationA company is integrating with a cloud-based partner portal so employees can use their existing corporate credentials to access the partner's applications without managing separate accounts. The security team wants the partner to trust the company's authentication process while ensuring the partner does not store employee passwords. Which solution best meets this requirement?
- A
Implement federated identity using SAML so the company acts as the identity provider and the partner acts as the service provider
- B
Configure local accounts for each employee in the partner portal and require password synchronization between both organizations
- C
Deploy full-disk encryption on employee laptops before allowing access to the partner portal
- D
Use network access control (NAC) to validate device posture before authenticating directly to the partner portal
Show answer and explanation
Correct answer: A
Explanation
The key requirement is to let users access a partner's resources with existing corporate credentials while the partner relies on the company's authentication process instead of storing passwords. That is the purpose of federation. In practice, this is commonly implemented with SAML, where the company serves as the identity provider and the partner serves as the service provider. After the user authenticates with the IdP, the SP consumes the signed assertion and grants access based on the established trust relationship. This aligns with common enterprise single sign-on and federation models described in vendor and standards documentation, including OASIS SAML guidance and identity federation best practices used by major cloud providers. The other options are valid security technologies in other contexts, but they do not address federated authentication between separate organizations.
- A. Correct.
Correct. Federation allows one organization to trust another organization's authentication assertions. In a common business-to-business scenario, the company's identity provider (IdP) authenticates the user and sends a SAML assertion to the partner's service provider (SP). This supports single sign-on and avoids the need for the partner to store or manage employee passwords. This is a standard use of federation in enterprise environments.
- B. Incorrect.
Incorrect. Creating local accounts in the partner portal is the opposite of federation because it requires separate identity management at the partner. Password synchronization also increases administrative overhead and risk exposure, since credentials are being duplicated across organizational boundaries rather than relying on trust-based authentication.
- C. Incorrect.
Incorrect. Full-disk encryption protects data at rest on endpoints, which is valuable for device security, but it does not establish identity federation or allow a partner to trust the company's authentication decisions. Someone might choose this because it improves security overall, but it does not solve the stated access-management requirement.
- D. Incorrect.
Incorrect. NAC can assess device compliance and posture before granting network connectivity, but it does not provide cross-domain identity trust between organizations. It is a control for endpoint/network admission, not a federation mechanism for partner application access.