Examkin

Question

Difficulty: MediumZero Trust Architecture Principles

A municipal water utility is re-architecting remote operational telemetry monitoring access for field maintenance engineers. The security architect must enforce Zero Trust Architecture (ZTA) principles to prevent unauthorized lateral movement across operational technology (OT) networks. Which of the following access control implementations best demonstrates the core Zero Trust tenets of explicit verification and least privilege?

  1. Deploying an inline Policy Enforcement Point (PEP) that evaluates user identity, endpoint health, and contextual risk for every individual database query before granting per-session access.Answer
  2. B
    Establishing a hardened virtual private network (VPN) concentrator to authenticate maintenance engineers at the perimeter before assigning their devices to a trusted internal management VLAN.
  3. C
    Granting full database modification permissions to all field engineer domain accounts automatically once single sign-on authentication completes successfully at shift start.
  4. D
    Placing traditional packet-filtering firewalls between network subnets to mitigate database vulnerabilities without performing application-layer authentication.

Answer

Deploying an inline Policy Enforcement Point (PEP) that evaluates user identity, endpoint health, and contextual risk for every individual database query before granting per-session access.
The option specifying an inline Policy Enforcement Point (PEP) directly aligns with NIST SP 800-207 Zero Trust Architecture principles. It enforces explicit verification by continuously inspecting user identity, device compliance posture, and contextual parameters for every database transaction, granting minimal per-session access without assuming network-based implicit trust.

Step-by-Step Solution

1
Analyze the core requirements of Zero Trust Architecture (ZTA).
ZTA requires eliminating implicit trust based on network location and enforcing continuous explicit verification and least privilege for every access request.
Traditional perimeter security assumes internal network traffic is trustworthy, whereas Zero Trust assumes breach and verifies continuously.
2
Evaluate the role of Policy Decision Points (PDP) and Policy Enforcement Points (PEP).
An inline PEP intercepting every transaction ensures dynamic contextual evaluation (user identity, device posture, location, risk) before granting temporal, per-session authorization.
Explicit verification must occur dynamically on a per-request basis rather than relying on a one-time perimeter check.

Key Concept

Zero Trust Architecture Principles - Explicit Verification and Continuous Authorization
Estimated Time:1m 30s
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic