An external contractor on a personal, unmanaged laptop needs access to one internal web application for a month. No software may be installed on the laptop, and the contractor must not receive network-level access. Which Secure Private Access method fits?
Select an answer to reveal the explanation.
Short Explanation
When you can't install anything and only one web app is needed, you just hand the contractor a door they can open with a browser. Browser-based ZTNA publishes that app through Secure Access, no client, no network access. The trap is client-based ZTNA — it's per-app too, but it breaks the no-install rule.
Full Explanation
Cisco Secure Access offers browser-based zero trust access for private web applications. The administrator defines the application as a private resource and enables browser-based access, Secure Access provides a URL through which the user authenticates with the identity provider, and the session is proxied to the application through the service and the resource connectors. Nothing is installed on the device, and the user can reach only that published application, not the internal network, which suits contractors and other unmanaged devices. Client-based zero trust access also provides per-application access and stronger device posture options, but it requires Cisco Secure Client on the endpoint, which the stem forbids. VPN as a service requires a client and grants network-level access, the opposite of the stated constraint. A network tunnel connects a site's edge device to Secure Access for site traffic; tunneling a contractor's home network is neither appropriate nor a private application access method for an individual user. Exam caveat: browser-based access applies to web applications; non-web protocols such as SSH or proprietary TCP applications generally need client-based access or VPN. Operational check: define the private resource with browser-based access, assign the contractor's identity in a private access rule, and confirm the contractor reaches the application while other internal addresses remain unreachable.