An organization mandates strict BYOD controls and does not permit endpoint agents on personal devices.

Option A satisfies the prohibition against installing endpoint agents while retaining application-level security. ZPA Browser Access provides clientless access to private web applications through a supported browser, so the private application is not exposed to the internet and the unmanaged device does not receive network-level access. Cloud Browser Isolation can isolate SaaS sessions and apply controls that protect data without placing active web content directly on the personal endpoint. Zscaler’s Browser Access documentation confirms that users can reach web applications without installing Zscaler Client Connector, while its BYOD secure-access guidance describes agentless access and isolation for unmanaged devices. Options B and D require Client Connector, contrary to the stated restriction. Option C provides neither application segmentation nor comparable data protection.

================