A hospital keeps patient portals on private ALBs in AWS while clinicians work from home and branch clinics without VPN clients. Security requires identity-aware, device-posture checks before reaching apps over the internet. Which hybrid connectivity control should the network architect configure to enforce Zero Trust access to private workloads?
Select an answer to reveal the explanation.
Short Explanation
VPNs open hallways, but you need a bouncer checking ID at each door. Verified Access grants per-request entry only when user and device both pass your policy.
Full Explanation
The correct approach places AWS Verified Access in front of private ALBs, integrates an identity provider like Okta or IAM Identity Center plus device trust from CrowdStrike or Jamf, and writes Cedar policies that evaluate user groups and device health on every request without VPN clients or public IPs. Establishing Site-to-Site VPN tunnels fails by concept because VPN provides network-level encrypted connectivity but lacks continuous identity and posture evaluation per application and expands lateral movement, while provisioning Direct Connect private VIFs fails because dedicated private lines suit stable data-center throughput, not dynamic work-from-home access, and still require separate authentication. Exposing internet-facing ALBs with Cognito and WAF fails because that pattern authenticates at the app layer and filters exploits but does not enforce Zero Trust network access with device attestation before packets reach the workload. For the exam, associate Verified Access with VPN-less Zero Trust to private apps, and in practice validate trust provider claims, log access attempts to CloudWatch, and test revocation when device compliance lapses.