SY0-701 - Security Operations (28% of the exam) - Section 4.6

Given a scenario, implement and maintain identity and access management.

Implement SSO, federation, and MFA to balance usability with strong authentication, and apply appropriate access control models - such as RBAC or ABAC - to enforce authorisation consistently. Use privileged access management to protect high-value accounts and design provisioning and deprovisioning workflows that prevent accumulation of excess permissions over time.

SSO and federationMFAaccess control modelsprivileged access managementprovisioning

Practice question for this objective

Free sampleSecurity Operationshard

Which option best describes the defining purpose of a privileged access management platform within an enterprise identity programme?

AIt serves as the primary identity provider for all employee and customer sign-ins so that a single console enforces password complexity and lockout policy across every application in the estate.
BIt brokers, vaults, and audits access to privileged accounts and high-impact systems, typically by issuing short-lived credentials, recording sessions, and requiring just-in-time approval rather than allowing standing administrative access. Correct
CIt replaces multi-factor authentication for administrators by binding a hardware token to each privileged account, allowing the holder to bypass session recording and approval workflows during routine maintenance work.
DIt performs lifecycle provisioning and deprovisioning of ordinary user accounts so that joiners, movers, and leavers are reflected promptly across human resources, directory, and downstream business applications.

Recognise privileged access management as brokered, vaulted, time-bound control of administrative access. A PAM platform exists to address the disproportionate risk of standing administrative privilege. It vaults privileged credentials so they are not held by individual administrators, brokers connections through a control point that records the session, and issues short-lived or just-in-time access tied to an approval workflow. That combination, rather than ordinary user identity management or simple MFA, is what the SY0-701 objective expects candidates to associate with PAM.

Why A is wrong: Tempting because PAM platforms do handle credentials, but acting as the general workforce or customer identity provider is the job of a standard IdP, not of a privileged access management tool.

Why B is correct: Correct. PAM is specifically aimed at the administrative tier: vaulting credentials, brokering connections, granting just-in-time elevation, and recording sessions for forensic and audit purposes.

Why C is wrong: Plausible to a candidate who equates strong authentication with privileged access, but PAM augments MFA rather than replacing it, and bypassing recording or approval defeats the entire control objective.

Why D is wrong: Plausible because lifecycle work is part of identity, but joiner-mover-leaver provisioning is the role of an identity governance and administration platform, not of a PAM tool.

See more SY0-701 practice questions, answers explained.

Exam traps in Security Operations

Answers that look right on this material and are not. Each one is a distractor from a different question in the SY0-701 bank for this domain.

Publish a written runbook that requires the help desk technician to complete account creation within two hours and account disablement within one hour of receiving the client email, and audit compliance with the runbook each month.
Why it is wrong: A tighter manual runbook is tempting because it appears to address delay directly, but it leaves humans in every step, scales poorly across clients, and cannot meet a minutes-level offboarding target reliably; orchestration is meant to remove the manual handoff, not document it.
A discretionary access control model in which the owner of each clinical record decides which colleagues may view or modify the chart.
Why it is wrong: DAC delegates permissioning to the record owner, which is unworkable in a hospital with millions of records and tens of thousands of staff, and gives auditors no way to reason about role populations or to revoke access centrally when staff move wards.
Synchronise the directory password hashes to the SaaS provider over a nightly secure file transfer and let users log in there with the same credentials.
Why it is wrong: Password synchronisation is tempting because it reuses the familiar credential, but it ships secrets to a third party, is not single sign-on at all, and creates two attack surfaces for the same password rather than federating the session.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.