Examkin

Question

Difficulty: HardZero Trust Architecture Principles

A fintech enterprise is restructuring its cloud-native microservices architecture to mitigate risks associated with lateral movement after a compromised service credential allowed unauthorized database queries. The security engineering team must align service-to-service communication with core Zero Trust Architecture (ZTA) principles. Which implementation strategy best enforces the Zero Trust principles of explicit verification and dynamic access control for every transaction request?

  1. A
    Establishing a persistent IPSec tunnel between the API gateway and database subnet, trusting all internal traffic that originates within the authorized gateway network boundary.
  2. Configuring the Policy Decision Point (PDP) to continuously evaluate identity attributes, contextual threat intelligence, and resource compliance state before issuing per-request authorization decisions to the Policy Enforcement Point (PEP).Answer
  3. C
    Authenticating the initial caller at the edge proxy via multifactor authentication (MFA) and issuing a long-lived session token that grants implicit authorization across all backend microservices.
  4. D
    Deploying an inline network intrusion prevention system (IPS) to terminate TCP sessions exhibiting abnormal database query volume without validating service identity or request authorization tokens.

Answer

Configuring the Policy Decision Point (PDP) to continuously evaluate identity attributes, contextual threat intelligence, and resource compliance state before issuing per-request authorization decisions to the Policy Enforcement Point (PEP).
In a Zero Trust Architecture (ZTA), access decisions are never granted implicitly based on network location or initial login state. Instead, the Policy Decision Point (PDP) continuously evaluates contextual attributes (such as service identity, device compliance, telemetry, and threat risk) for every request, instructing the Policy Enforcement Point (PEP) to enforce fine-grained access control.

Step-by-Step Solution

1
Analyze the core architectural requirements of Zero Trust Architecture (NIST SP 800-207 framework).
Zero Trust requires explicit verification of every access attempt, continuous risk assessment, least privilege access, and strict separation between the control plane and data plane.
Implicit trust based on network location or session duration must be eliminated to prevent lateral movement.
2
Differentiate between the functional roles of the Policy Decision Point (PDP) and Policy Enforcement Point (PEP).
The PDP acts in the control plane to evaluate policy parameters (user identity, device health, risk score, context) and generates authorization decisions. The PEP acts in the data plane to allow or block individual communication flows based on PDP directives.
Decoupling policy computation from traffic forwarding ensures granular, dynamic, and centrally managed security enforcement.
3
Evaluate the choices against Zero Trust tenets.
Evaluating identity attributes and contextual posture per-request via the PDP to instruct the PEP is the only strategy that eliminates implicit perimeter trust and enforces explicit per-request verification.
Options relying on subnet trust, long-lived session tokens, or pure anomaly detection fail to implement dynamic, identity-centric access control.

Key Concept

Zero Trust Architecture Control Plane Separation and Continuous Explicit Verification
Estimated Time:2m 0s
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic