Examkin

Question

Difficulty: Very hardZero Trust Architecture Principles

A financial enterprise operates a microservices environment governed by Zero Trust Architecture (ZTA) principles. A remote system administrator successfully completes multi-factor authentication (MFA) from a corporate-managed endpoint. Ten minutes into the session, the endpoint's telemetry indicates that its local endpoint detection and response (EDR) agent has been disabled, and the connection origin dynamically shifts to an unknown unmanaged network. Which of the following actions best demonstrates the principle of continuous verification in this scenario?

  1. The Policy Engine dynamically re-evaluates session risk signals and instructs the Policy Administrator to terminate session access or request step-up posture validation despite prior authentication.Answer
  2. B
    The perimeter security gateway allows all ongoing API traffic to proceed uninterrupted because the session established a valid cryptographically authenticated IPsec tunnel during login.
  3. C
    The identity provider validates that the user's Kerberos ticket remains unexpired, assuming valid identity tokens automatically grant permission to perform all requested administrative actions.
  4. D
    An inline network intrusion detection system automatically reconfigures database firewall schemas as a corrective control rather than querying the centralized policy control plane.

Answer

The correct answer states that the Policy Engine dynamically re-evaluates session risk signals and instructs the Policy Administrator to terminate session access or request step-up posture validation despite prior authentication.
Zero Trust Architecture mandates continuous verification and explicit validation. Initial multi-factor authentication does not grant persistent trust. When contextual factors change during an active session (such as EDR agent disabling or IP address changes), the Policy Engine must immediately re-assess threat signals and direct the Policy Administrator to modify, step-up, or terminate access privileges.

Step-by-Step Solution

1
Analyze the state change presented in the enterprise scenario under NIST SP 800-207 Zero Trust guidelines.
Identified that although initial authentication succeeded, post-login environmental context (EDR disabled, network location changed) degraded device trustworthiness.
Zero Trust mandates that access decisions are dynamic and continuous throughout the entirety of every transaction.
2
Determine the functional roles of Zero Trust logical components (Policy Engine, Policy Administrator, Policy Enforcement Point).
The Policy Engine evaluates threat context and security posture to render access decisions, instructing the Policy Administrator to update enforcement rules at the Policy Enforcement Point.
Continuous verification requires real-time telemetry processing and dynamic policy enforcement across active network connections.

Key Concept

Zero Trust Architecture Principles - Continuous Verification and Dynamic Authorization
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic