In a Zero Trust model, accessing external SaaS applications requires a connection that is both secure and performant. This is achieved by establishing a dynamic, direct-to-app path that bypasses traditional network-centric bottlenecks like backhauling traffic through a central data center. This approach, central to Secure Access Service Edge (SASE) frameworks, ensures a better user experience by reducing latency while applying consistent security policies. The connection is brokered by a Zero Trust platform, not the underlying network, ensuring security is maintained regardless of the user's location.

B. Hardwired connections are an outdated requirement; modern access must support mobile and wireless users from any location.

C. Perimeter-based firewalls are part of the legacy security model that Zero Trust aims to replace due to their ineffectiveness for distributed users and cloud apps.

D. Access is brokered by a Zero Trust exchange or platform, not a daemon running within the third-party SaaS application's infrastructure.

1. Zscaler. (n.d.). What is Zero Trust? Zscaler Resources. Retrieved from zscaler.com. The document states, "Zero trust architecture... connects them directly to the apps and resources they need, never to corporate networks." This direct connection is the dynamic and effective path.

2. Zscaler. (2023). The Zscaler Zero Trust Exchange Architecture. White Paper. Page 4 discusses how the architecture "eliminates the need to backhaul traffic, reducing latency and improving the user experience."