Every branch sends SaaS to one virtual firewall in a cloud hub, and no branch breaks out locally. There is no private circuit to the SaaS provider. Which model is this?
Select an answer to reveal the explanation.
Short Explanation
Moving the shared door into a cloud hub does not give each branch its own door. You still have a centralized internet gateway. The virtual firewall does not make the breakout local, and there is no private circuit to the SaaS provider.
Full Explanation
A centralized internet gateway is one shared internet exit that the branches backhaul to. Putting the firewall in a cloud hub rather than an office does not change the model: SaaS traffic still passes through that shared gateway. Direct internet access would mean each branch exits locally, which is not happening here. Dedicated SaaS connectivity requires a private path to the SaaS provider; a hub being in a cloud region does not create that path, and the scenario explicitly says there is no private circuit. An MPLS handoff from each branch to the SaaS provider is not described or built. Exam caveat: if one branch later gets its own internet exit, that branch’s traffic could be direct or indirect at that site, while the other branches remain centralized through the hub. Practical check: verify that a branch’s SaaS flow reaches the hub firewall before the provider and that the branch has no local internet session for that flow.