A managed device on a known corporate LAN cannot reach a private application through the...

Answer B is correct. When the corporate LAN already provides a valid direct route to the private application, a Trusted Network bypass can tell Client Connector not to forward that application through ZPA on that network. Zscaler supports bypassing ZPA for an application when the user is on a trusted network, and Client Forwarding Policy rules are evaluated using application specificity and top-down, first-match logic. The trusted-network definition and bypass scope must therefore be narrow and stable so that the same traffic is still forwarded and protected when the device leaves the corporate LAN. A broader App Segment changes application matching but does not repair the forwarding path. Inspection Policy affects content handling, and an Access Policy allow cannot help if traffic never reaches the correct ZPA path. See Zscaler’s Client Forwarding Policy overview and client forwarding configuration.