A device meets VPN-trusted-network criteria where existing corporate controls apply, and administrators want to minimize...

Option C matches the stated VPN-trusted design. Zscaler’s Forwarding Profiles overview explains that when a full-tunnel VPN client is active and the network is classified as VPN-Trusted, Client Connector does not forward user traffic to Zscaler. Selecting No Forwarding therefore avoids a second tunnel and lets the organization’s established VPN and corporate controls handle the traffic. Zscaler’s VPN interoperability guidance also warns against route-based tunneling for VPN-Trusted networks because it can create interoperability problems. Application or IP bypasses remain separate Application Profile decisions for specifically excluded flows. Z-Tunnel 2.0, Local Proxy, and PAC proxy enforcement would introduce forwarding behavior that the scenario is trying to avoid. Administrators should validate trusted-network detection and bypass scope so that No Forwarding is used only in the intended corporate context.