Examkin

Question

Difficulty: MediumZero Trust Architecture Principles

An enterprise organization is transitioning from a legacy remote-access VPN infrastructure to a Zero Trust Architecture (ZTA). During the redesign, a security architect must define how access requests to sensitive corporate applications are evaluated by the Policy Engine and Policy Enforcement Point. Which of the following operational practices best aligns with the core Zero Trust principle of explicit validation and continuous verification?

  1. Evaluating user identity, device health, and environmental context dynamically for every individual resource access request regardless of network positionAnswer
  2. B
    Authenticating user credentials once at initial session initiation and granting implicit trust to all subsequent subnet traffic
  3. C
    Assigning administrative system authorizations automatically whenever a user successfully completes multi-factor authentication
  4. D
    Configuring the Policy Enforcement Point as a corrective control intended primarily to isolate compromised endpoints after a security breach occurs

Answer

Evaluating user identity, device health, and environmental context dynamically for every individual resource access request regardless of network position
The correct response highlights the core pillar of Zero Trust Architecture: inspecting and validating every request individually using identity, device security posture, and runtime context. It eliminates implicit perimeter trust entirely.

Step-by-Step Solution

1
Identify core Zero Trust Architecture (ZTA) principles
ZTA relies on 'never trust, always verify', enforcing continuous verification, explicit validation, and least privilege.
Legacy perimeter security assumes internal traffic is trusted, whereas Zero Trust treats all networks and requests as untrusted.
2
Analyze how the Policy Engine (PE) and Policy Enforcement Point (PEP) operate
The Policy Engine evaluates context (user status, device integrity, location) and decides whether to grant access, while the PEP enforces this decision per request.
Continuous verification requires evaluating every request dynamically rather than relying on one-time authentication.
3
Select the option that correctly embodies dynamic, request-level verification
Evaluating user identity, device posture, and context dynamically per request regardless of location represents true Zero Trust implementation.
This meets the requirement of explicit validation across both control plane decisions and data plane enforcement.

Key Concept

Zero Trust Architecture Principles (Continuous Verification and Explicit Validation)
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic