A records company must reach a SaaS provider that sells a private interconnect for that application, and the contract says the records must not cross the public internet. Which model fits?
Select an answer to reveal the explanation.
Short Explanation
You were offered a private door, and your contract says you may not use the street. You take the dedicated interconnect the SaaS provider sells. Direct office internet, a centralized gateway that exits to the internet, and a security provider that delivers the app over the internet all put your records on the public network.
Full Explanation
Dedicated connectivity uses the private or peering path that the SaaS provider offers, so application traffic does not ride the public internet. The records company has that offer, and its contract forbids public-internet transit, making the dedicated interconnect the matching model. Direct internet access sends office traffic onto the public internet; inspecting it with a local firewall does not change the underlying path. Backhauling traffic to a centralized internet gateway can unify policy, but the gateway still exits to the public internet, so that model breaks the contract. Indirect access through a cloud security provider inspects the flow, then reaches the application over the internet as described, and therefore fails the same constraint. That would differ only if the security provider itself used the SaaS provider’s private interconnect, which is not the delivery described here. Exam caveat: dedicated connectivity is an option only when the SaaS provider actually sells the private path; directing traffic toward a public SaaS address does not create one. Practical check: confirm that routes for the SaaS prefixes use the private interconnect, and verify that those prefixes do not appear in internet-edge ACL hits.