Examkin

Question

Difficulty: HardZero Trust Architecture Principles

A biomedical research enterprise is migrating its hybrid cloud infrastructure to align with Zero Trust Architecture (ZTA) principles to protect sensitive patient records and proprietary research data. Which of the following architectural strategies MUST the security engineering team implement to strictly enforce Zero Trust principles? (Select TWO).

  1. Implement continuous, risk-based session evaluation at the Policy Decision Point (PDP) that dynamically reassesses access grants based on endpoint telemetry and user behavior.Answer
  2. Enforce microsegmentation around individual workload components so that all lateral east-west network traffic is explicitly authenticated, authorized, and encrypted.Answer
  3. C
    Establish implicit trust for internal network traffic originating from behind corporate VPN ingress gateways once identity verification is completed.
  4. D
    Rely on single multi-factor authentication (MFA) prompts during initial session establishment to grant persistent authorization rights across all internal microservices.

Answer

The correct architectural strategies are implementing continuous, risk-based session evaluation at the Policy Decision Point (PDP) using dynamic telemetry, and enforcing microsegmentation around individual workload components so that all lateral east-west traffic is explicitly authenticated, authorized, and encrypted.
Zero Trust Architecture requires continuous explicit verification and strict resource isolation. Implementing dynamic telemetry checks at the Policy Decision Point (PDP) ensures access grants are re-evaluated continuously against current risk state. Enforcing microsegmentation prevents lateral attacker movement by inspecting and authorizing all internal east-west traffic regardless of network location.

Step-by-Step Solution

1
Evaluate Zero Trust core tenets regarding continuous verification and dynamic access control.
Dynamic policy evaluation at the Policy Decision Point (PDP) ensures access permissions dynamically adapt to changes in device posture, threat intelligence, and user risk metrics.
Static initial logins are insufficient; continuous posture and risk assessment are required under Zero Trust principles.
2
Analyze network isolation and segmentation requirements under an assumed breach posture.
Microsegmentation restricts lateral movement by requiring explicit authorization and encryption for all internal workloads, treating all east-west network traffic as un-trusted.
Perimeter defenses and legacy VPNs grant implicit trust once inside, which contradicts Zero Trust requirements.

Key Concept

Zero Trust Architecture Principles: Continuous Verification, Microsegmentation, and Explicit Access Controls
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic