A manufacturer runs zero-trust access from factory tablets to an analytics workload in AWS, with no VPN, a strict contractor BYOD policy, and a requirement for per-request identity and device posture checks. Tablets already use an identity provider for SSO. Which control should the architect implement to secure hybrid-to-AWS application communication?

AWS Verified Access is correct because it provides VPN-less zero-trust application access that integrates with the existing identity provider as a trust provider and enforces access policies evaluating user identity plus device posture on every request, which directly satisfies contractor BYOD, SSO reuse, and continuous verification without network tunnels. Federated Amazon Cognito authentication improves SSO user authentication and coarse authorization but does not collect or evaluate device security posture per request, leaving the posture requirement unmet and functioning as session authentication rather than continuous zero-trust enforcement. Application Load Balancer mutual TLS strongly authenticates tablet certificates at request time and is widely used for client authentication, yet it validates certificate possession alone without device health, compliance, or user context from identity and device trust providers. AWS PrivateLink with IAM endpoint policies is a sound pattern for private service connectivity within AWS networks, but it is network-centric and oriented to VPC-to-service access, so it cannot provide internet-based zero-trust access for unmanaged BYOD tablets or perform per-request identity and posture evaluation. For exams, distinguish application-layer zero-trust access that checks identity and posture every request from network-layer private connectivity or one-time authentication that grants broad access after login. In practice, confirm the trust provider syncs IdP groups and endpoint posture from tools like CrowdStrike or Jamf, then validate with Verified Access logging and test access from compliant and noncompliant tablets.