A company with a mostly remote workforce wants to retire the practice of backhauling user traffic to headquarters. It needs a cloud-delivered service that provides secure web gateway filtering, cloud access security broker controls, and zero trust access to private applications, without replacing its existing WAN routing. Which solution BEST fits?

Security Service Edge is a cloud-delivered set of security services that typically includes a secure web gateway for web filtering, a cloud access security broker for visibility and control over cloud application use, and zero trust network access for private applications. Enforcement happens at the provider's points of presence, so remote users avoid backhauling through headquarters and the WAN design is unchanged. Software-defined WAN manages and optimizes how traffic is routed across multiple WAN links, and while some products include basic security features, its purpose is connectivity rather than delivering web filtering, broker controls, and zero trust access; the scenario also states the WAN routing should remain unchanged. Security information and event management aggregates and correlates logs to support detection and investigation; it does not sit in the traffic path enforcing policy. A next-generation firewall at headquarters can provide strong inspection, but it requires traffic to reach headquarters, which is the backhauling the company wants to retire. Exam caveat: when networking functions such as SD-WAN are combined with these security services, the broader architecture is commonly described as secure access service edge, so the presence or absence of WAN changes is the distinguishing detail. Operational check: route user web and private-application traffic through the service, apply policies consistently, and confirm logs reach the SIEM.