An organization wants to reduce implicit trust while preserving user access to both internet and private applications.
Which configuration approach best aligns with a least-privilege design that also reduces the attack surface?
A.
Apply URL Filtering and Cloud App Control for outbound access, and enforce ZPA application segmentation with inside-out connectivity to restrict private-application reachability
B.
Adopt SD-WAN hairpinning for SaaS access and use VLAN-based controls to partition legacy environments while policies converge
C.
Standardize on shared subnets and rely on internal firewalls to control access, while using broad URL categories to shape outbound traffic
D.
Increase TLS decryption coverage for all destinations and rely on VPN access control lists to constrain private-network discovery during coexistence
Option A applies least privilege separately to internet/SaaS traffic and private applications. URL Filtering and Cloud App Control provide granular outbound policy by destination, application, user, and action. For private access, ZPA grants access to authorized applications rather than extending the user onto the network. Its inside-out App Connector model keeps applications undiscoverable from the internet and reduces exposure to lateral movement. The ZPA data sheet describes application segmentation, inside-out connectivity, and attack-surface reduction, while Zscaler’s Access Policy documentation explains policy-based application access. VLANs, shared subnets, traditional firewalls, and VPN ACLs remain network-centric and can preserve implicit reachability. TLS inspection is an important security control, but expanding decryption alone does not create least-privileged private-application authorization or eliminate network exposure.
================
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit