A company moved its on-premises applications to several SaaS providers. As a result, the security team is concerned about accounts being compromised. Which of the following should the security tem…

Multifactor authentication (MFA) primarily prevents unauthorized access but does not limit the actions a compromised account can take once authenticated, which is a crucial aspect of reducing the overall risk of an account compromise.

Single sign-on (SSO) centralizes authentication but does not inherently reduce the risk of individual account compromise or limit access permissions.

Federation enables interoperability between identity systems and is often used with SSO, but it does not directly reduce the risk of account compromise or limit an account's privileges.

Role-based access control (RBAC) limits the privileges an attacker would gain if an account is compromised, ensuring users and, by extension, attackers only have access to the minimum necessary resources. By implementing RBAC across multiple SaaS providers, the security team can significantly reduce the potential impact and overall risk associated with a successful account compromise.

A Virtual Private Network (VPN) secures network traffic but does not directly address the risk of an account being compromised at the application layer or limit the permissions of an authenticated account.