Examkin

Question

Difficulty: Very hardZero Trust Architecture Principles

An enterprise organization is modernizing its security framework by implementing Zero Trust Architecture (ZTA) principles across its hybrid multi-cloud infrastructure. To validate the deployment, the lead security architect must map foundational Zero Trust principles to their specific technical operational mechanisms. Match each Zero Trust Architecture principle on the left with its correct technical implementation mechanism on the right.

  • Continuous Explicit VerificationRe-evaluating identity credentials, device posture, and environmental signals dynamically on every resource request, regardless of initial session authentication or network location.
  • Microsegmentation and Blast Radius ReductionEnforcing granular workload-to-workload application layer controls and mutual TLS (mTLS) to prevent unauthorized lateral movement inside the internal network.
  • Assume Breach and Least Privilege AccessRestricting subject access through just-in-time (JIT) ephemeral credentials and scoping permissions strictly to the minimal actions necessary for a specific task.
  • Control Plane and Data Plane SeparationDecoupling the policy decision engine and policy administrator logic from inline gateways that handle active application traffic inspection and forwarding.

Answer

Continuous Explicit Verification matches with dynamically re-evaluating credentials, device posture, and context on every request. Microsegmentation and Blast Radius Reduction matches with enforcing workload-to-workload application layer controls and mTLS to prevent lateral movement. Assume Breach and Least Privilege Access matches with restricting access through just-in-time ephemeral credentials. Control Plane and Data Plane Separation matches with decoupling policy decision engines from inline data inspection gateways.
The correct pairings accurately reflect NIST SP 800-207 Zero Trust tenets. Continuous Explicit Verification ensures ongoing dynamic checks per request rather than static login. Microsegmentation prevents internal lateral movement by dividing resources into granular zones using mTLS. Assume Breach limits threat impact by combining minimal access rights with short-lived tokens. Control Plane and Data Plane separation distinguishes decision-making logic from traffic enforcement gateways.

Step-by-Step Solution

1
Analyze Continuous Explicit Verification
Identified that Zero Trust mandates 'never trust, always verify', requiring real-time contextual validation per transaction.
Initial login status or network location cannot grant implicit trust for subsequent transactions.
2
Analyze Microsegmentation and Blast Radius Reduction
Matched with application-level isolate controls such as mTLS and software-defined perimeters.
Legacy flat networks allow unchecked lateral movement; microsegmentation contains breaches within tight boundaries.
3
Analyze Assume Breach and Least Privilege Access
Matched with just-in-time (JIT) temporary access tokens providing minimal scope.
Designing for compromise requires minimizing rights granted to users or services to limit damage.
4
Analyze Control Plane and Data Plane Separation
Matched with separating policy decision engines (PE/PA) from inline traffic proxies (PEP).
Logical separation ensures management and policy evaluation remain isolated from physical data movement.

Key Concept

Zero Trust Architecture Operational Principles
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic