Parks seasonal kiosks should launch only a timekeeping application and must not inherit payroll and HR. Which Access design meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
A kiosk policy should be a single-ride ticket, not the all-staff season pass. Give timekeeping its own Access policy. Reusing payroll and HR on that kiosk is how a seasonal tablet opens the wrong doors.
Full Explanation
Parks seasonal kiosks should launch only a timekeeping application and must not inherit payroll and HR. Create a dedicated Access policy for the timekeeping application instead of reusing the all-staff policy—a single-ride ticket, not the all-staff season pass. Reusing the all-staff Access policy fails by concept because kiosks would inherit payroll, HR, and timekeeping together. Assigning every SaaS application in the tenant to the kiosk smart group and relying on users not opening the extras fails because visibility and weak hope are not authorization controls. Using an NSX-T distributed firewall allow-any from the kiosk VLAN to the internet and skipping Access fails because network any-any does not enforce per-app identity policy for timekeeping-only. Exam caveat: least-privilege kiosk SaaS access needs a dedicated Access policy for the allowed app—not all-staff reuse, not assign-everything, not skip Access for DFW any-any. Operational check: sign in on a seasonal kiosk and confirm only timekeeping succeeds, attempt payroll/HR and confirm deny, and verify the kiosk is not attached to the all-staff Access policy. Strip Hub catalog assignment for payroll/HR from the kiosk smart group so tiles match Access policy.