A security architect compares zero trust network access with the company's full-tunnel remote access VPN for reaching private applications. What is the key access-model difference between them?
Select an answer to reveal the explanation.
Short Explanation
A VPN hands you a key to the building; ZTNA walks you to one office door, checks your badge, and opens just that door. That per-application access, decided by identity and device context, is the whole point. The trap answer flips the two models around — read carefully.
Full Explanation
Zero trust network access brokers connections between an authenticated user and a specific private application. Each access decision considers identity, device posture and other context, and the user is connected only to the applications a policy allows, without being placed on the internal network. Applications are not exposed directly to the internet, and lateral movement is limited because the user cannot reach anything they were not explicitly granted. A traditional full-tunnel remote access VPN, by contrast, authenticates the user and then gives the device an address on, or routed reach into, internal networks, so access control depends on separate internal filtering. The option that places ZTNA users on the internal segment and restricts VPN users to one application reverses the two models. ZTNA does not require applications to move to a public cloud; connectors in the data center make private applications available in place. ZTNA traffic is encrypted end to end, not just credentials, so describing it as protecting only the login misstates the technology. Exam caveat: some private applications with complex port behavior still suit VPN, which is why Secure Access offers both ZTNA and VPN as a service. Operational check: from a ZTNA-connected test device, confirm the permitted application opens while a ping or port scan to another internal host fails.