Examkin

Question

Difficulty: HardZero Trust Architecture Principles

A cloud engineering team is refactoring a legacy microservices application to adhere to Zero Trust Architecture principles. During initial login, an edge gateway authenticates the incoming client request using mutual TLS (mTLS) and issues a signed JSON Web Token (JWT). However, backend microservices are configured to trust any request carrying a valid JWT signature without evaluating real-time user context, device compliance, or risk metrics for individual downstream API transactions. Which Zero Trust Architecture operational vulnerability is most directly presented by this configuration?

  1. Failing to enforce continuous verification by allowing initial session authentication to grant implicit trust for subsequent API transactions.Answer
  2. B
    Relying on implicit perimeter trust by assuming all containerized network traffic on the internal overlay segment is safe from interception.
  3. C
    Confusing identity authentication protocols with user authorization privileges by utilizing mTLS at the ingress edge gateway.
  4. D
    Misclassifying the edge API gateway as a corrective control rather than a preventive control in the data plane control flow.

Answer

Failing to enforce continuous verification by allowing initial session authentication to grant implicit trust for subsequent API transactions.
Zero Trust Architecture requires explicit, continuous verification of every request based on all available data points (such as user identity, device posture, location, and risk state). Validating a token signature once upon entry without re-assessing context during subsequent microservice interactions creates a window of implicit session trust that contradicts Zero Trust tenets.

Step-by-Step Solution

1
Analyze the technical scenario context
The architecture authenticates clients upfront via mTLS and issues a token, but downstream microservices blindly trust the token signature without re-evaluating risk, context, or posture.
Identifying what checks are present versus what checks are missing exposes the architectural gap.
2
Map the technical gap to core Zero Trust tenets
Zero Trust mandates explicit validation and continuous verification on every resource request regardless of prior session authentication state.
Static acceptance of initial authentication violates the 'never trust, always verify' requirement for ongoing session evaluation.
3
Select the option that precisely targets continuous verification failure
The option identifying reliance on initial session authentication over continuous contextual re-evaluation directly matches the flaw.
Accepting static tokens without real-time risk evaluation allows hijacked sessions or compromised endpoints to execute actions without continuous checks.

Key Concept

Continuous Verification and Explicit Validation in Zero Trust Architecture
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic