A manufacturing firm connects factory tablets over the internet to private apps in AWS without VPN clients, requiring identity-aware access, device posture checks, and no inbound hybrid firewall openings. Headquarters uses Direct Connect for office traffic. Which hybrid access design meets the tablet workload communication requirements?
Select an answer to reveal the explanation.
Short Explanation
You can give your factory tablets access to private apps without VPN clients while still checking who is connecting and whether their devices meet your requirements. AWS Verified Access applies zero-trust checks to each request, while your headquarters office traffic can remain on Direct Connect.
Full Explanation
AWS Verified Access is designed for zero-trust access to private applications over the internet without VPN clients. It evaluates user identity through an identity provider and device posture through trust providers, and it does not require inbound hybrid firewall openings. That fits the factory tablets while leaving headquarters office traffic on Direct Connect. An internet-facing Application Load Balancer with Amazon Cognito can authenticate users over HTTPS without VPN software, but it does not evaluate endpoint posture; valid credentials on an unmanaged or jailbroken tablet could still grant access. AWS Client VPN with SAML and device certificate checks can verify identity and devices without inbound firewall openings, but it requires VPN client software, which the tablet requirement rules out. Extending the headquarters Direct Connect private virtual interface is suitable for office and data-center connectivity, but mobile internet devices cannot use that private path directly; routing them through headquarters adds latency and dependence on office network availability. For exams, distinguish user authentication from device trust: both are required here, along with clientless internet access. In practice, verify identity-provider group claims, device certificate or EDR attestation status, Verified Access policy logs, and that tablets reach only the Verified Access endpoint while office prefixes remain on Direct Connect.