A contractor needs access to one internal HR web application from a personal laptop. The architect requires that the contractor's other local traffic stays off the corporate network, that the application stay unreachable from the public internet, and that device health be verified at the moment of authorization for every session. Which access design meets the zero trust network access requirements?
Select an answer to reveal the explanation.
Short Explanation
With zero trust network access, your identity and device health are checked at the start of every session, and you get access only to the private app—not the public internet—while your other traffic stays off the corporate network. It’s like a ticket that opens one door for one visit, not a pass to the whole building.
Full Explanation
The correct design uses zero trust network access to authorize access to the specific private application, rather than granting broad network access. Its session-level checks verify both identity and device health when access is authorized, while the application remains off the public internet and unrelated laptop traffic does not enter the corporate network. The split-tunnel VPN is a plausible way to keep non-HR traffic local and reach a private application, but checking posture only when the tunnel is established does not verify device health at authorization for every session. The identity-aware reverse proxy can enforce per-session checks and avoid routing unrelated traffic through the enterprise, but a public-facing proxy makes the application service reachable through a public internet endpoint, contrary to the stated exposure requirement. The full-tunnel VPN can keep the application private and recheck posture for each session, but it sends the contractor’s other local traffic through corporate egress instead of keeping that traffic off the corporate network. Exam caveat: distinguish an application that is private behind a gateway from one whose access endpoint is publicly reachable; strong authentication does not by itself make a public endpoint private. Practical check: verify the actual routing table and gateway exposure, then confirm logs show device-health evaluation at each application-session authorization.