An organization wants to reduce implicit trust while preserving user access to both internet and...

Option A applies least privilege separately to internet/SaaS traffic and private applications. URL Filtering and Cloud App Control provide granular outbound policy by destination, application, user, and action. For private access, ZPA grants access to authorized applications rather than extending the user onto the network. Its inside-out App Connector model keeps applications undiscoverable from the internet and reduces exposure to lateral movement. The ZPA data sheet describes application segmentation, inside-out connectivity, and attack-surface reduction, while Zscaler’s Access Policy documentation explains policy-based application access. VLANs, shared subnets, traditional firewalls, and VPN ACLs remain network-centric and can preserve implicit reachability. TLS inspection is an important security control, but expanding decryption alone does not create least-privileged private-application authorization or eliminate network exposure.

================