Transit IT wants every packet on a rider-information tablet to enter the civic LAN through always-on IPsec. Why is Workspace ONE Tunnel the wrong product for that goal?
Select an answer to reveal the explanation.
Short Explanation
Tunnel is a named-app pass, not a whole-tablet on-ramp. Always-on IPsec for every process is a different VPN story, and Horizon Client or Content lockers are not why Tunnel is wrong here. The exam definition of Tunnel is managed-app traffic, not a full-device network extension.
Full Explanation
Workspace ONE Tunnel is the wrong product when transit IT wants every packet on a rider-information tablet to enter the civic LAN through always-on IPsec, because Tunnel is application-scoped access for managed Workspace ONE apps rather than a full-device network extension. That whole-device requirement is a different VPN design than Tunnel's exam definition. Rider-facing tablets that must hairpin all traffic for policy inspection need a device VPN design, and selecting Tunnel would leave non-managed processes off the intended path. Tunnel does not replace Horizon Client, so claiming it cannot carry IP for that reason misstates both products. Tunnel is not limited to wrapping Blast Extreme display protocol; its purpose is per-app access for managed apps, which is still not full-device IPsec. Tunnel is not a content locker; it does carry network traffic, but only for nominated managed applications. Exam caveat: Associate items often include partially true statements about Tunnel while the decisive concept remains scope—per-app versus whole device. Operational check: If every process including personal browsers must traverse always-on IPsec, document a device VPN requirement and reserve Tunnel for managed-app micro-VPN cases such as Boxer or GIS.