A customer wants 200 contractors to reach a single internal HR portal. The laptops are unmanaged, many people connect from outside the corporate network, and the security team insists that access is granted per person and only after the device is confirmed healthy. The team wants browser-based access to just that one application, with no VPN client or network-level access granted. Which remote access design should you deploy so that only a named, healthy contractor can open that portal?
Select an answer to reveal the explanation.
Short Explanation
Use zero trust network access to let each contractor reach only the HR portal after you verify their identity and device health. It’s like giving each person a key to one room, not the whole building.
Full Explanation
A zero trust network access design can provide a per-application grant: an identity-aware service authenticates the person, evaluates configured device-health requirements, and exposes only the named application to that session. The specific product and endpoint setup must support the required health checks; unmanaged devices may need an agent or another supported health signal. A remote access VPN with an access control rule fails the stated requirement for browser-based access with no VPN client or network-level access, since it builds a network-layer tunnel. The zero trust design that grants access to the whole application server subnet fails the single-application requirement. An FTD access control rule based on source addresses and the portal server does not by itself establish per-person identity or device health. Practical check: after authenticating from a contractor device that passes the configured health checks, verify that the portal loads and that access to other internal hosts is denied.