Examkin

Question

Difficulty: HardZero Trust Architecture Principles

A software enterprise recently migrated its legacy inventory management application to a hybrid cloud environment. To protect application access, the security team configured a Web Application Firewall at the network edge and mandated multi-factor authentication during user login. However, once an employee successfully authenticates at the start of their shift, backend microservices honor all subsequent data requests based on the request originating from an internal IP subnet, without re-evaluating risk telemetry, user behavior, or device compliance. Which core principle of Zero Trust Architecture is directly violated by this security design?

  1. Continuous verification and explicit validation, because session context and authorization must be evaluated dynamically per request rather than assuming persistent trust after initial authentication.Answer
  2. B
    Perimeter-based implicit trust, because network subnets should automatically inherit high trust levels once edge firewall rules and initial MFA pass inspection.
  3. C
    Authentication enforcement, because verifying identity at session initiation inherently satisfies all authorization requirements across internal microservices.
  4. D
    Corrective control application, because detective logging controls must supersede preventive identity checks once network boundary traffic is established.

Answer

Continuous verification and explicit validation, because session context and authorization must be evaluated dynamically per request rather than assuming persistent trust after initial authentication.
The correct answer accurately identifies that Zero Trust Architecture eliminates implicit trust based on physical or logical network location. Under Zero Trust guidelines (such as NIST SP 800-207), access decisions must be explicitly validated and continuously re-evaluated on a per-request basis using contextual signals (e.g., device health, resource sensitivity, threat intelligence), rather than relying on a single initial MFA event at the network border.

Step-by-Step Solution

1
Analyze the operational scenario provided in the stem.
Identified that authentication occurs only once at login, after which access is granted implicitly based on internal network IP subnets.
Understanding the current security posture reveals where implicit trust assumptions are introduced.
2
Evaluate the identified flaw against Zero Trust tenets.
Zero Trust mandates 'Never Trust, Always Verify', requiring continuous assessment of identity, device health, and context for every transaction.
Static trust based on network location or initial login violates explicit validation and continuous verification principles.
3
Select the option that correctly identifies the violated Zero Trust principle.
The requirement for dynamic, per-request context re-evaluation directly highlights continuous verification as the missing principle.
Per-request authorization prevents lateral movement and unauthorized access from compromised internal endpoints.

Key Concept

Continuous Verification and Explicit Validation in Zero Trust Architecture
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic