Examkin

Question

Difficulty: MediumZero Trust Architecture Principles

A logistics enterprise is migrating its internal supply chain microservices from a legacy network zone model to a Zero Trust Architecture (ZTA). The engineering team must ensure that service-to-service communications are secured strictly according to Zero Trust principles. Which of the following design decisions directly align with Zero Trust Architecture principles for this deployment? (Select TWO.)

  1. Implement mutual TLS (mTLS) to cryptographically authenticate identity and encrypt transit data for every API request between microservices, regardless of logical network location.Answer
  2. Enforce continuous transaction-level authorization by dynamically evaluating contextual risk parameters and access token validity for each request.Answer
  3. C
    Bypass per-request authentication for communication originating from within the container cluster's internal overlay network segment.
  4. D
    Rely on initial edge gateway single sign-on (SSO) authentication to grant blanket authorization across all downstream backend microservices.
  5. E
    Deploy passive network intrusion detection system (IDS) monitoring tools as inline preventive controls to automatically block unauthorized microservice calls.

Answer

Implementing mutual TLS for cryptographic identity and data protection across all requests, alongside enforcing continuous transaction-level authorization based on contextual risk evaluation, directly aligns with Zero Trust Architecture principles.
Zero Trust Architecture operates on the core tenets of 'never trust, always verify' and assuming breach. Implementing mutual TLS ensures explicit verification of service identity and cryptographic data protection for every request across all boundaries. Furthermore, continuous transaction-level authorization re-evaluates security posture and context dynamically rather than relying on static or initial authentication states.

Step-by-Step Solution

1
Evaluate the baseline Zero Trust principle regarding implicit trust and network boundaries.
Zero Trust mandates that no request is inherently trusted based on network position, requiring explicit verification and encryption for all inter-service traffic via mutual TLS (mTLS).
Microservices operating inside a container cluster or internal network must still authenticate and encrypt all data in transit.
2
Analyze how authorization decisions should be made within a Zero Trust Architecture.
Authorization must be continuous and contextual, evaluating security parameters and session tokens on every transaction rather than relying on one-time initial authentication.
Static initial authentication at the boundary does not account for mid-session risk changes or lateral movement threats within the environment.
3
Eliminate choices based on flawed assumptions regarding perimeter reliance, control types, and authentication scope.
Bypassing authentication for internal cluster traffic, trusting edge gateway authentication for downstream access, and misclassifying passive detective controls as inline preventive enforcement all violate Zero Trust principles.
Zero Trust rejects perimeter-based implicit trust and requires proper alignment of Policy Enforcement Points with dynamic policy evaluation.

Key Concept

Zero Trust Architecture Principles (Explicit Verification and Continuous Authorization)
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic