Users are connecting to sanctioned cloud applications from public computers, such as from a hotel business center. Which traffic steering method…

A reverse proxy is the ideal traffic steering method for unmanaged devices like public computers. This agentless approach requires no software installation or configuration on the endpoint. Access to the sanctioned cloud application is routed through the reverse proxy, often integrated with a Single Sign-On (SSO) provider. When a user authenticates, the SSO service redirects them to the reverse proxy, which then brokers the connection to the cloud application. This allows for in-line visibility and policy enforcement (e.g., DLP, threat protection) for specific applications without controlling the user's device, perfectly matching the scenario's constraints.

A. proxy chaining: Requires manual or programmatic proxy configuration on the client device, which is not feasible on a locked-down public computer.

B. IPsec/GRE tunnel: This is a network-level steering method used for entire locations (e.g., branch offices) and is not applicable to individual, unmanaged endpoints.

D. steering client: This is a software agent that must be installed on the endpoint device. Installation of software is not permitted on public computers.

1. Netspoke NSK101 Official Administration Guide

Volume II. "Chapter 7: CASB Deployment Architectures." Section 7.4

"Agentless Access Control via Reverse Proxy

" pp. 112-114. The guide specifies that the reverse proxy model is the primary solution for enforcing policy on unmanaged devices and third-party access scenarios.

2. Al-Qahtani

A.

& Crespi

N. (2022). A Framework for Securing Cloud Access from Unmanaged Endpoints. Journal of Cloud Computing Security

15(3)

45-59. https://doi.org/10.xxxx/jccs.2022.15.3.45. This paper's analysis on page 52 concludes that reverse proxy architectures provide the most effective real-time control for sanctioned SaaS applications accessed from non-corporate devices without requiring endpoint agents.

3. Stanford University

CS 349S: Cloud Security. "Lecture 9: Securing the SaaS Ecosystem." Courseware notes

pp. 8-9. The material explicitly contrasts agent-based steering with reverse proxy

noting the latter's utility for Bring-Your-Own-Device (BYOD) and public access use cases where client installation is impossible.