A branch office has many devices, including printers and IoT sensors, on which no endpoint client can be installed, yet all of the site's internet traffic must be inspected by Cisco Secure Access. What is the appropriate way to connect the site?
Select an answer to reveal the explanation.
Short Explanation
When you can't put a client on every device, you protect the whole building's front door instead. A network tunnel from the branch router or firewall carries all the site's traffic to Secure Access, no client needed. The trap is the resource connector — it's for reaching private apps, not for sending a branch's internet traffic.
Full Explanation
Cisco Secure Access supports network tunnels that connect a site to the service using IPsec with IKEv2. A supported edge device at the branch, such as a router, firewall, SD-WAN edge or Meraki MX, establishes the tunnel to a Secure Access network tunnel group, and routing or policy-based forwarding sends the site's internet-bound traffic into it. Every device behind the edge, including printers and IoT sensors that cannot run a client, is then covered by Secure Access internet security policy, attributed to the network tunnel identity. Installing Secure Client on a single jump host and using it as a gateway is not a supported traffic forwarding design and would create a fragile single point of failure. Publishing devices as private resources makes them reachable for authorized users through private access; it does nothing to inspect the devices' own outbound internet traffic. Resource connectors initiate outbound connections from a data center or cloud environment so that Secure Access can reach private applications there; they do not collect internet traffic from local devices. Exam caveat: tunnel identity provides site-level policy; per-user policy for people at that branch needs additional identity sources. Operational check: confirm the tunnel shows as established in the network tunnel group status, then generate traffic from a printer subnet and verify the activity search shows it under the branch tunnel identity.