Examkin

Question

Difficulty: HardZero Trust Architecture Principles

An enterprise health system is updating its clinical application platform to align with Zero Trust Architecture (ZTA) principles. During an architectural review, an engineer proposes that once a medical professional completes multi-factor authentication (MFA) at the central identity provider (IdP) and receives a session token, all subsequent API requests sent to internal microservices during their 8-hour shift should be implicitly trusted without re-assessing device posture or access policies. Which core Zero Trust Architecture principle does this proposed design fail to uphold?

  1. Continuous verification, because access requests must be evaluated dynamically on a per-request basis using contextual signal inputs rather than relying on initial authentication success.Answer
  2. B
    Control plane isolation, because internal microservice communication must rely on traditional perimeter firewalls to establish trust boundaries across corporate zones.
  3. C
    Least privilege enforcement, because multi-factor authentication mechanisms determine user permissions rather than verifying identity credentials.
  4. D
    Explicit validation, because session tokens issued by an identity provider function strictly as detective controls rather than preventive access controls.

Answer

Continuous verification, because access requests must be evaluated dynamically on a per-request basis using contextual signal inputs rather than relying on initial authentication success.
The correct option accurately identifies continuous verification as the missing principle. Zero Trust dictates that no implicit trust is granted based on network location or initial authentication. Every transaction must be continuously authorized using real-time contextual attributes (e.g., identity, device security posture, anomalous behavior patterns).

Step-by-Step Solution

1
Analyze the proposed design in the scenario.
The proposed architecture grants an 8-hour implicit trust window following an initial MFA authentication at the Identity Provider.
Identifying the flaw requires evaluating where implicit trust is being improperly introduced.
2
Evaluate the proposal against Zero Trust tenets.
Zero Trust Architecture assumes that networks are hostile and mandates continuous authentication and authorization for every access request.
Relying on a static 8-hour token without re-checking contextual signals (such as device health or location changes) violates continuous verification.
3
Select the principle that addresses this specific architectural deficiency.
Continuous verification explicitly addresses the requirement to continuously evaluate risk and context rather than trusting prior authentication states.
This directly restores Zero Trust compliance by eliminating temporal implicit trust.

Key Concept

Zero Trust Continuous Verification
Estimated Time:2m 0s
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic