Examkin

Question

Difficulty: MediumZero Trust Architecture Principles

A manufacturing enterprise is updating its network security model for factory floor industrial IoT sensors that transmit operational metrics to an enterprise analytics platform. Under the legacy network model, any device connected to the internal factory subnet was implicitly trusted. Which of the following technical implementations best aligns this environment with Zero Trust Architecture (ZTA) principles?

  1. Require explicit, continuous authentication and dynamic authorization for every data payload, regardless of whether the traffic originates inside the factory subnet.Answer
  2. B
    Deploy a next-generation perimeter firewall around the factory subnet to grant full network access to all internal sensors after passing initial network admission control.
  3. C
    Perform identity authentication once at the beginning of each shift and rely solely on initial user logon status for device data transmission permissions.
  4. D
    Reclassify internal network switches as compensating physical security controls so that internal transmission cables do not require encryption or inspection.

Answer

Requiring explicit, continuous authentication and dynamic authorization for every data payload regardless of network origin.
The correct answer aligns directly with Zero Trust Architecture (ZTA) principles by eliminating implicit trust derived from network location. Zero Trust requires that every device, user, and data transaction be explicitly authenticated and authorized using real-time context and continuous validation, even if the request originates from an internal factory subnet.

Step-by-Step Solution

1
Analyze the legacy architecture described in the scenario
The legacy model relies on implicit trust granted to devices residing on the internal factory subnet.
Traditional perimeter-based security assumes devices behind the internal firewall are trustworthy.
2
Apply Zero Trust Architecture tenets (such as NIST SP 800-207)
Zero Trust dictates 'never trust, always verify' regardless of physical or logical network position.
All communication must be explicitly authenticated, authorized, and continuously validated on a per-request basis.
3
Identify the option that enforces per-request continuous validation without network location bias
Enforcing continuous authentication and dynamic authorization for all payloads fulfills ZTA requirements.
This removes implicit perimeter trust and applies granular access controls to every transaction.

Key Concept

Zero Trust Architecture enforces explicit, continuous verification of identity and authorization for every access request, regardless of network location.
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic