Securing SaaS-based applications: MFA vs. App Gateway

350-701 By islever Editorial Last updated

Describe the controls used to protect against phishing and social engineering attacks

Short answer

A Two-factor authentication must be enabled to secure SaaS-based applications by verifying user identity without requiring infrastructure changes.

Question

What must be enabled to secure SaaS-based applications?
  1. two-factor authentication Correct Answer
  2. end-to-end encryption
  3. application security gateway
  4. modular policy framework

Key Takeaways

The exam tests the distinction between infrastructure ownership and access security in a SaaS model, where the common trap is selecting network-level controls like gateways that the customer cannot deploy.

This question addresses the primary control required to secure SaaS-based applications, focusing on identity and access management. It establishes that while infrastructure security is managed by the provider, securing user access via multi-factor authentication is the critical responsibility of the consumer.

Common mistake: Many candidates select 'application security gateway' (C), mistakenly believing they can or should place a gateway in front of a SaaS application, ignoring the shared responsibility model where the provider manages the perimeter.

Expert Analysis

Why the Answer Is Correct

Two-factor authentication (MFA) is the most effective and universally applicable control for securing SaaS applications because identity is the new perimeter. In a SaaS environment, the vendor manages the underlying infrastructure, meaning customers cannot install hardware or software appliances at the data center level. Instead, the customer's primary security lever is controlling who accesses the application, making strong authentication essential.

Why the Other Options Are Wrong

An application security gateway (C) typically refers to an on-premises or edge device protecting internal web apps; it is not feasible for public SaaS services where the customer has no network visibility. End-to-end encryption (B) is often handled by the SaaS provider and may not be configurable by the user, whereas MFA is a standard tenant configuration. The modular policy framework (D) is a Cisco-specific firewall architecture irrelevant to general SaaS security.

Community Comment Notes

Several users initially debated between MFA and Application Security Gateways. As one commenter noted, "SaaS is like Office365... The only logical choice is MFA" because the organization doesn't own the underlying infrastructure. Another user corrected their initial vote for C, stating, "After rethinking this question I have to agree that answer A has more sense," recognizing the limitations of client-side deployment in cloud environments.

Exam Strategy

When analyzing cloud security questions, always apply the Shared Responsibility Model. If the option involves modifying the physical or core virtual infrastructure of the SaaS provider, it is likely incorrect. Focus on controls available to the tenant, such as identity management, data classification, and endpoint security.

Frequently Asked Questions

Why is an application security gateway not used for SaaS?

SaaS providers host the application globally; customers cannot deploy a gateway at the provider's data center. MFA works at the identity layer regardless of location.

Does the customer ever handle encryption in SaaS?

Customers can enable encryption at rest or in transit if supported, but MFA is the universal first step for access control that applies to all SaaS tenants.

More 350-701 FAQ →

Discussion 27 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 27

  1. sull3y 👍 5
    C. Application security gateway. To secure SaaS-based applications, an application security gateway must be enabled. This is a security solution that sits between the user and the SaaS application, providing a secure connection and monitoring traffic to ensure that it meets security policies. Two-factor authentication (A) is a security measure that adds an extra layer of authentication to access a system or application, but it alone is not sufficient to secure SaaS-based applications. End-to-end encryption (B) can also be an important security measure for SaaS-based applications, but it is typically used to protect data in transit, rather than securing the SaaS application itself.
  2. unclemonkeyboy 👍 3 Answered A
    I would have to say A. SaaS is like Office365. An organization doesn't own the underling infrastructure to put in a ALG or MPF. HTTPS is enabled by default. So the only logical choice is MFA.
  3. Jariaya1 👍 3
    End - to - End Encryption https://www.fortunesoftit.com/9-best-practices-to-secure-saas-applications/
  4. achille5 👍 3 Answered C
    Obviously it's C
  5. Jessie45785 👍 2 Answered C
    https://www.strongdm.com/what-is/application-gateway#:~:text=An%20application%20gateway%20is%20a%20security%20measure%20that,services%20with%20the%20login%20credentials%20for%20the%20app. What is an Application Gateway (App Gateway)? An application gateway is a security measure that protects web applications. They replace traditional web applications that require the same login credentials as the data center. Instead, users access application gateways through mobile apps and cloud services with the login credentials for the app.
Show 22 more comments
  1. achille5 👍 2
    Ignore above, i select A. As per question, "What must be enabled" Some SaaS-based applications may include an application security gateway as part of their service offering, others may not. However, provider responsible for infra security and software, customer is responsible to enabled the two-factor authentication to secure user authentication to access the application. Just saying.
  2. SegaMasterSystemAdmin 👍 2 Answered A
    The answer is definitely A. Cannot be C because in a SaaS environment, the provider is responsible for the network infrastructure, security, and the application. The client is only responsible for the data and the people, which makes A the most sensible choice.
  3. ezpzls 👍 2
    The following practices are recommended for securing SaaS environments and assets: 1. Enhanced Authentication 2. Data Encryption ... Therefore the best answer is A https://www.cynet.com/sspm/saas-security-the-challenge-and-7-critical-best-practices/
  4. Cruxten 👍 2 Answered B
    I agree both A & B are correct answers but given SaaS implies my data is traversing the Internet I'll choose encrypting my data before securing the login with a second factor.
  5. Jessie45785 👍 2
    After rethinking this question I have to agree that answer A has more sense: --- i vote for A
  6. CCNP21 👍 2 Answered B
    https://www.getastra.com/blog/cms/saas-security-guide/
  7. Stan_8 👍 2 Answered A
    I would go with A.
  8. Tthurston1 👍 1
    Now this is a good one lol... Securing SaaS-based applications typically require a combination of security measures - making options A-C all valid in the grand scheme of things, but of course, we must select the BEST possible answer for this question. I would eliminate C for starters - Although an application security gateway provides a more comprehensive solution than options A & B because it provides a centralized point for monitoring and controlling access to SaaS-based applications, it is also a functionality that should be primarily provided by your vendor. Now this is where it gets interesting because options A & B are BOTH valid solutions to securing SaaS applications and can be implemented at the CUSTOMER level. If I had to choose, however, I would go with Option A. According to Cisco DUO's website - phishing is not only a common security threat, but it is also the #1 cause of security breaches. See link below: https://duo.com/solutions/phishing-prevention
  9. XBfoundX 👍 1 Answered C
    Cloud Access Security Broker (CASB) / Application Security Gateway acts as an intermediary between cloud providers, cloud-based applications, and cloud consumers to enforce an organization’s security policies, track user behavior, and protect sensitive data." Conclusion: Since the question specifically asks what must be enabled to secure SaaS-based applications (and not just user login), the answer is C. application security gateway.
  10. ddev3737_111 👍 1
    What about ? Application Security Gateway - As it provides multiple security measures such as firewall protection, intrusion detection and prevention, and SSL decryption, all in one solution, an application security gateway is a comprehensive solution to securing SaaS-based applications. By acting as a mediator between the application and the network, it can help ensure that sensitive data is protected while in transit and at rest.
  11. Premium_Pils 👍 1 Answered C
    I that would an option, then I would go for Cisco cloud lock, or Cisco secure access, but none of these are listed. In this case, Cisco application security gateway seems to be the closest. This solution safeguards cloud applications based on this article. https://www.cisco.com/site/us/en/products/security/cloud-application-security/index.html
  12. CyberGhost666 👍 1 Answered C
    To secure SaaS-based applications, you need a way to monitor, control, and enforce security policies for apps that are outside your network perimeter. This is where an: ✅ Application Security Gateway (also known as a Cloud Access Security Broker – CASB)
  13. Silexis 👍 1
    A CASB solution is not going to prevent credentials theft. As the internal security of the application itself is under cloud provider responsibility, securing the application in such context, in my opinion relates to MFA, this is why I would stay with A
  14. ITVI 👍 1 Answered A
    Unless it specifically calls out a Cisco product, C would have been my choice, therefor I will go with A. Most SaaS products are fairly encrypted so no to B for me as well. D is irrelevant.
  15. ITPro21 👍 1 Answered A
    Opinion - Because it is referencing SaaS rather than IaaS or Cloud Hosting, I will got with A.
  16. cyberwhizzy0 👍 1
    Keeping this here: https://www.cyberark.com/what-is/app-gateway/
  17. Premium_Pils 👍 1
    *If that would be an option...
  18. arditv 👍 1
    Must be end to end encryption
  19. Rododendron2 👍 1 Answered B
    B is a must, so B it is
  20. Tthurston1 👍 1
    And A isn't?
  21. Emlia1 👍 1
    probably B
  22. kloug 👍 1
    Answer a

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide