CompTIA SY0-701 Bundle

Identity federation allows one trusted identity provider to authenticate users for external applications. It may help a reporting client establish a user session, but federation alone does not grant the client narrowly scoped permission to call the employee's calendar API. The immediate requirement is constrained delegated API authorization without revealing the user's password.

SAML federation uses identity assertions for sign-on to compatible service providers. A SAML login may establish who the employee is, but it does not inherently issue calendar API access scopes to a separate reporting tool. The scenario is explicitly about delegated resource access rather than an interactive browser SSO assertion.

LDAP allows authorized clients to query directory entries and group memberships inside an enterprise environment. It is not designed to obtain a short-lived delegated token for a third-party calendar API with user consent. Querying the employee's directory account cannot replace OAuth's resource-owner authorization flow or secure API access scope.

SAML provides signed XML identity assertions for suitable enterprise service-provider sign-on flows. It can authenticate users, but the mobile application already uses an OAuth-style authorization server and needs the standardized identity layer for that ecosystem. An OIDC ID token more directly meets the requirement without introducing a separate SAML assertion exchange.

OAuth 2.0 delegates permissions for a client to access protected resources on behalf of a user. It does not itself define a standard ID token proving who authenticated to the relying party. Using a resource API access token as a login assertion can create audience and trust vulnerabilities. Add OpenID Connect for client authentication claims.

LDAP directory queries retrieve user and group attributes from a directory server under configured authorization. They do not establish a modern OAuth-based sign-in session or issue a verifiable identity token to a mobile app. Direct directory access from an untrusted mobile client could also expose directory interfaces unnecessarily.

SAML federates authentication through XML assertions exchanged between identity and service providers, typically for web SSO. The legacy intranet system does not need interactive federation or tokens; it only needs to look up existing employee group membership inside the LAN. A directory query is the simpler and more direct interface.

OAuth delegation grants limited resource access with scoped tokens to an application acting for a user. Group membership lookup from an internal directory does not require user-consent-based delegation to a protected API. OAuth could participate in a broader architecture, but it is not the specific directory query protocol asked for here.

Time-limited privileged elevation grants administrative rights for narrowly approved tasks and removes them afterward. The legacy intranet application needs read-only directory group information, not temporary administrator privileges. Adding privileged access would increase exposure without improving its ability to query existing group membership.

ABAC evaluates subject, object, and environment attributes, such as department, device posture, sensitivity, and time. It can encode rules that resemble job functions but is more flexible than the requested simple permission assignment by stable employee roles. The scenario names two professional groups with predefined needs rather than dynamic contextual conditions.

Mandatory access control uses centrally enforced labels and clearances that ordinary file owners cannot override. It is valuable in classified environments but is not the most direct approach for standard nursing-versus-billing job duties. The scenario describes assigning allowed record types by employment function, which maps naturally to roles.

Discretionary ACLs allow a resource owner to grant access to named users or groups under the system's policy. They can be useful for collaboration but would make sensitive healthcare record access depend on individual owners' ad hoc choices. Standardized nursing and billing permissions should be enforced through centrally governed job roles and reviewed consistently.

A schedule-based access restriction allows entry only at specified times or days, which is appropriate when a contractor may view records during business hours. The described rule depends on several simultaneous factors including clearance, document sensitivity, location, and device health. A fixed schedule alone ignores those attributes and would not produce the required contextual decision.

RBAC grants permissions based on assigned functions such as nurse, billing clerk, or database administrator. It is effective for stable job duties, but the current rule also depends on location, device compliance, and sensitivity for each request. Role assignment alone does not dynamically combine these environmental and resource attributes without additional policy layers.

Discretionary owner-managed ACLs let an authorized object owner share resources with other users or groups. The question instead requires centrally determined conditions tied to clearance, document sensitivity, location, and managed device state. An individual document owner cannot be relied upon to evaluate and enforce all those contextual rules correctly for every access.

ABAC evaluates centrally specified conditions on subject, object, and environment attributes. It can govern collaboration systems, but the question specifically permits a document owner to choose colleagues using the object's access-control list without changing central classification policy. That owner-directed grant is a discretionary control, not necessarily attribute-based authorization.

RBAC assigns permissions to predefined organizational functions and is convenient for consistent access across employees doing the same work. It does not primarily describe a specific document owner choosing individual collaborators for one shared file. A central role may still bound who is eligible, but the requested permission decision is discretionary at the document level.

LDAP directory queries retrieve users, groups, and related attributes from a directory service. They can supply identities for an ACL user picker but do not establish who may grant permission to a particular document. The distinguishing mechanism is the object's owner-managed discretionary access list, not directory lookup itself.

ABAC can incorporate sensitivity labels and clearance attributes into conditional authorization. It is a flexible policy expression mechanism but does not by itself identify the specific security model in which the creator cannot override centrally assigned classification labels and clearance rules. The stem asks for mandatory, owner-independent enforcement of classified-resource access.

A scheduled access rule restricts when an account may use a service, often for contractors or temporary staff. It does not ensure that a file owner cannot disclose a classified record to someone lacking clearance. The crucial restriction is tied to security labels and centrally enforced permissions, not to time of day.

RBAC assigns permissions by job functions or organizational roles. A role might correspond to a clearance group, but ordinary RBAC alone does not establish mandatory security labels that even file creators cannot override. The scenario specifically rejects owner-directed sharing and requires classification-based control governed by a central authority.

A role assignment can grant a vendor read-only access to equipment logs based on its job function. If that role remains valid around the clock, it does not enforce the explicitly limited weekday hours. The scenario already assumes normal authorization is configured, so adding another unconditional role permission would fail the remaining schedule restriction.

Device compliance rules restrict resource access based on managed-device encryption, patch state, or endpoint health. Those checks can be useful additional conditions for contractor access. A fully compliant device may still connect at midnight, so posture policy without a time-based condition does not satisfy the fixed 08:00–16:00 weekday access limit.

A discretionary document ACL lets an authorized owner grant sharing permissions to specific users or groups. It cannot reliably enforce a centrally approved schedule if the owner can modify it independently. The vendor's access must close outside the prescribed hours regardless of an individual file owner's choices, requiring an enforced temporal policy.

Changing passwords when compromise is suspected avoids needless frequent rotation and reduces predictable increments. That is good password lifecycle policy, but a user may still be tricked into submitting a password and live SMS one-time code to a phishing proxy. The attack calls for a phishing-resistant authentication protocol, not merely better password expiration rules.

A password and PIN are both memorized knowledge secrets, so combining them does not establish two different authentication factor types. Such a login remains vulnerable to credential harvesting and replay by an adversary-in-the-middle proxy. The question requires resistance to real-time OTP relay attacks, which this additional knowledge field does not provide.

A managed secrets vault stores service credentials and can rotate API keys or privileged passwords under policy. That improves machine-credential governance but does not bind a human login response to the genuine website origin. A phishing proxy can still relay a captured OTP even if unrelated backend secrets are rotated regularly.

A memorized PIN is not a possession factor merely because it may be entered on a device. Possession requires control of a distinct authenticator, such as a hardware key or registered token. The screen asks for two secrets that the user remembers, so neither field proves ownership of a separate physical authenticator.

Biometric inherence uses a characteristic of the person, such as a fingerprint or face, evaluated through an appropriate authenticator system. A numeric PIN is a remembered string, not a biological characteristic. Entering that value alongside a password remains within the knowledge category and cannot be relabeled as inherence.

Multiple form fields do not establish multifactor authentication. Two independently typed knowledge secrets can increase credential complexity but still rely on the same factor category, so the login fails the explicit two-category requirement. Count factor types based on what is proved, not the number of prompts or boxes displayed during sign-in.

A password and PIN are both knowledge-based secrets and do not add a separate possession or inherence factor. This observation is relevant when evaluating MFA but does not explain how to resolve excessive compulsory password changes. The scenario describes daily rotation causing predictable patterns; the correction is the password-change policy itself.

An origin-bound FIDO2 security key provides strong phishing-resistant authentication and may be useful to modernize the login system. It does not directly fix a policy that still demands changing a strong memorized password every day. Deploying a hardware key without revising arbitrary expiration rules would preserve the predictable-increment problem.

Periodic access certification asks responsible owners to attest that employees still need their roles, applications, and permissions. It can reduce stale privileges after staff transfers but is not a password-expiration control. The prompt addresses weak patterns caused by forcing users to change otherwise strong passwords every day, not unauthorized role membership.