The AWS App Connectors must have ordinary routed reachability across Direct Connect to every required on-premises application address and port. They must also retain outbound connectivity to the ZPA cloud. Zscaler’s App Connector deployment prerequisites specify an outbound TLS tunnel over TCP 443, and the App Connector overview confirms that App Connectors initiate outbound connections and require no inbound ports from the Zscaler cloud. Option A preserves both halves of the path: connector-to-application routing across Direct Connect and connector-to-Service Edge egress. Client microtunnels do not terminate through inbound rules on the connectors. ZPA does not require publishing or NAT-exposing private application servers. Inbound cloud ACLs also contradict the inside-out App Connector model. Routing, security groups, network ACLs, DNS resolution, and application-port reachability should be verified before the group is placed into service.