SY0-701 Question 379
Select 2A company is moving its employee onboarding and offboarding process to an automated workflow that integrates the HR system, identity provider, ticketing platform, and cloud environment through APIs. The security team wants to reduce manual effort while enforcing least privilege and preventing configuration drift. Which TWO actions should the team implement to best meet these goals?
- A
Use role-based templates to automatically provision accounts, group memberships, and baseline resource access when HR marks a user as hired, and automatically disable access when HR marks the user as terminated
- B
Allow each department manager to directly assign cloud administrator privileges during onboarding so employees can work immediately without waiting for security review
- C
Implement guard rails in infrastructure-as-code and CI pipelines to block deployments that create overly permissive security groups or expose services publicly without approval
- D
Create a nightly script that deletes and recreates all user accounts and cloud resources so permissions are reset every 24 hours
- E
Configure the workflow to open a ticket only after a failed login occurs, since successful provisioning does not require tracking or audit evidence
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are the ones that automate access lifecycle management while embedding preventive security controls into provisioning and deployment workflows. Using HR as the authoritative trigger for user provisioning and deprovisioning is a well-established identity governance practice. Applying RBAC templates helps enforce least privilege and reduces manual errors. Separately, implementing guard rails in infrastructure-as-code and CI pipelines helps detect and prevent insecure resource provisioning, such as broad firewall rules or public exposure of services.
These practices align with common security guidance from sources such as NIST SP 800-53 for access control and configuration management, NIST SP 800-61 for incident handling and workflow integration, and vendor best practices for IAM lifecycle automation and DevSecOps pipelines. In real environments, APIs commonly connect HR platforms, identity providers, ticketing systems, and cloud services so onboarding, offboarding, escalation, and approval steps can be automated while preserving logging and auditability.
- A. Correct.
Correct. This approach supports automated user provisioning and deprovisioning based on an authoritative source such as HR, which is a common best practice. Using role-based access control (RBAC) templates helps enforce least privilege and consistency for new hires, while automatically disabling accounts during offboarding reduces the risk of orphaned accounts. This is a practical use of automation, APIs, and integrations across identity and ticketing systems.
- B. Incorrect.
Incorrect. Allowing managers to assign administrator privileges directly bypasses centralized review and increases the risk of privilege creep and excessive permissions. Although it may speed onboarding, it conflicts with least privilege and separation of duties. A candidate might choose this because it appears operationally efficient, but it creates a significant security weakness.
- C. Correct.
Correct. Guard rails implemented through infrastructure-as-code validation and CI/testing pipelines are specifically designed to prevent insecure configurations before deployment. Blocking overly permissive security groups or unintended public exposure is a strong example of automation used to enforce policy consistently and reduce configuration drift. This aligns with secure DevOps and change-control practices.
- D. Incorrect.
Incorrect. Deleting and recreating all accounts and resources every night is disruptive, unnecessary, and likely to cause outages, data loss, and audit issues. It does not represent a realistic or secure provisioning strategy. Someone might choose this option because it sounds like a way to reset permissions regularly, but it is not an appropriate control.
- E. Incorrect.
Incorrect. Ticket creation and audit logging should be part of provisioning and deprovisioning events, not just tied to failed logins. Organizations typically need evidence of access changes for compliance, approvals, and investigations. This option misunderstands the purpose of ticketing and workflow tracking in automated security operations.