The security team notices that the Always On VPN solution sometimes fails to connect. This leaves remote users unprotected because they cannot connect to the on-premises web proxy. Which of the following changes will best provide web protection in this scenario?

Network access control primarily focuses on managing and securing device access to a network, which does not directly address the issue of web protection during VPN outages. While it can enhance overall security, it does not provide immediate content filtering for users who are unable to connect via the VPN.

Configuring the local gateway to point to the VPN might improve connectivity but does not resolve the problem of users remaining unprotected when the VPN fails to establish. This option does not introduce any content filtering or protection measures for users who cannot connect to the VPN.

Creating a public NAT for the on-premises proxy allows external access to internal resources but does not ensure that remote users are protected against web threats when the VPN connection fails. This solution does not provide any content filtering capabilities, leaving users vulnerable to potential security risks.