The ZTNA Connector 2.0 offers a distinct advantage by automatically discovering private applications within the data center or cloud. Based on this discovery, it can suggest granular, application-based Security policy rules. This capability is fundamental to implementing a Zero Trust, least-privilege access model, allowing administrators to move away from broad network-level access (typical of service connections) to precise, application-specific controls. This simplifies policy creation and strengthens the security posture for private application access, making it a compelling choice for an enterprise architect focused on Zero Trust principles.

A. Both ZTNA connectors and service connections control traffic to internal resources; this is not a unique differentiator for the ZTNA connector.

B. This describes a service connection, which uses IPSec tunnels for site connectivity, not the ZTNA connector's function.

C. Supporting traffic sourced from on-premises resources to mobile users is a primary use case for a service connection, not a ZTNA connector.

1. Palo Alto Networks TechDocs, "Get Started with ZTNA Connector 2.0," ZTNA Connector 2.0 Concepts section, App Discovery subsection. This document states, "ZTNA Connector 2.0 can discover applications in your data center and suggest security policy rules for them. This helps you to easily migrate your applications from a legacy VPN solution to a ZTNA solution." This directly supports the correct answer.

2. Palo Alto Networks TechDocs, "Prisma Access Administrator’s Guide," Service Connections section. This guide describes a service connection as an IPSec tunnel that "provides Prisma Access with a route to your internal services and resources." It operates at the network layer and does not include application discovery capabilities, which differentiates it from the ZTNA connector.

3. Palo Alto Networks TechDocs, "ZTNA Connector Overview." This document clarifies that the ZTNA connector provides "secure access to specific applications" rather than granting broad network access, which is a key tenet of Zero Trust and is facilitated by features like application discovery.