Court records staff need Workspace ONE Tunnel so a case-management app can reach the records VLAN. Which component-firewall approach is correct?
Select an answer to reveal the explanation.
Short Explanation
Tunnel is a keyed side door for one app, not a moving van for the whole courthouse. Allow the Tunnel server from managed devices and skip a wide-open split-tunnel.
Full Explanation
Court records staff need Workspace ONE Tunnel so a case-management app can reach the records VLAN. Allow only the Tunnel server ports and FQDNs from managed devices—a keyed side door for one app—instead of unfiltered VPN to every civic SaaS. Full split-tunnel from managed devices to every civic SaaS fails by concept because it over-permits Tunnel into a general SaaS VPN rather than per-app enablement. Allowing unmanaged home PCs to reach the Tunnel server on all ports fails because Tunnel is for managed endpoints; unmanaged sources and all-ports access defeat device trust. Publishing the Tunnel server on the public website subnet with no device check fails because citizen web hosting and Tunnel are different trust domains. Exam caveat: Tunnel enablement is managed-device documented port and FQDN allow—not split-tunnel everything, not unmanaged, not public-subnet publication. Operational check: from a managed device, confirm the case-management app reaches the records VLAN via Tunnel; from an unmanaged home PC, confirm Tunnel is denied; verify the public website subnet does not front the Tunnel listener. Capture Tunnel FQDNs and ports in the courts runbook so temporary split-tunnel exceptions do not become permanent.