A hospital must give three outside billing vendors access to one claims web app. The app must stay hidden from the public internet, every new connection must recheck identity and device health, and vendor reach must stop at that single application. Which application access design meets all three requirements?
Select an answer to reveal the explanation.
Short Explanation
You need one key for one room, and a zero trust network access broker can grant access to that app after checking who you are and how healthy your device is. A VPN that routes to a shared subnet permits reach beyond the app, a site-to-site tunnel authenticates the gateway rather than each user and device, and a public reverse proxy does not keep the app hidden from the internet.
Full Explanation
With a ZTNA design configured for private application access, a broker evaluates identity, group membership and device posture for a new connection, then permits access only to the specified resource. A private-app design can keep the application off the public internet and avoid handing the user general network access. The remote-access VPN option routes vendors to a shared subnet containing other hosts, so reach is not limited to the claims app. The site-to-site VPN option authenticates the vendor gateway and applies an app-host ACL, but does not recheck each user's identity and device health for each new connection. The reverse proxy option checks users at sign-in but exposes a public endpoint, so it fails the hidden-application requirement. Exam caveat: ZTNA and VPN offerings vary in access granularity, so verify that the configured policy restricts access to the individual application. Practical check: from an untrusted network, verify that the app has no public endpoint, then confirm that a new connection triggers the required identity and posture checks.