A clinic chain forbids both local breakout and data-center backhaul. Every Microsoft 365 session must be inspected by a cloud security provider first. Which SaaS model is this?
Select an answer to reveal the explanation.
Short Explanation
You are not allowed to step outside locally, and you are not allowed to go home first. You send Microsoft 365 to the cloud security provider and only then on to Microsoft, which is indirect access. The two paths the chain forbade are exactly the other models.
Full Explanation
Indirect SaaS access puts a cloud security provider between the user and the application. The clinics cannot break out locally and cannot backhaul to the data center, and they must be inspected by that provider before Microsoft 365. The provider path is the one that satisfies all three constraints. Direct internet access is the local breakout they forbade, even if a local firewall is present. A centralized internet gateway at the data center is the backhaul they are not allowed to use. A dedicated private circuit would be a private path to the SaaS provider. The requirement is inspection by the cloud security provider, not a private circuit that replaces that provider. Exam caveat: the provider's own path to Microsoft may still use the internet. Indirect describes where you steer the session for inspection. It does not by itself promise a private last hop. Operational check: a clinic trace toward Microsoft 365 should hit the cloud security provider first, and the data-center firewall should not see the session.