Examkin

Question

Difficulty: Very hardZero Trust Architecture Principles

A healthcare enterprise is deploying a Zero Trust Architecture (ZTA) across its clinical telemetry systems. During an active diagnostic data transmission session, an endpoint compliance agent reports that a workstation's local security baseline has been modified unexpectedly, though the clinician's multi-factor authentication (MFA) token remains valid and unexpired. Which of the following operations executed by the Zero Trust control plane best demonstrates the principle of continuous verification?

  1. The Policy Decision Point (PDP) recalculates the session's dynamic trust score based on telemetry metrics and instructs the Policy Enforcement Point (PEP) to terminate the connection despite valid user credentials.Answer
  2. B
    The Policy Enforcement Point (PEP) maintains the active data plane connection unhindered because the initial mutual TLS session originated from a trusted internal hospital VLAN segment.
  3. C
    The Policy Decision Point (PDP) issues a secondary MFA prompt to the user, operating under the assumption that successful identity re-verification validates endpoint baseline integrity.
  4. D
    The Policy Enforcement Point (PEP) automatically modifies core edge firewall ACLs to block external outbound traffic while permitting unrestricted lateral movement across internal database subnets.

Answer

The Policy Decision Point (PDP) recalculates the session's dynamic trust score based on telemetry metrics and instructs the Policy Enforcement Point (PEP) to terminate the connection despite valid user credentials.
Under Zero Trust Architecture (ZTA) principles, explicitly verifying every request requires continuous authentication and contextual evaluation. When device telemetry indicates baseline configuration tampering, the Policy Decision Point (PDP) dynamically re-evaluates the contextual risk score and signals the Policy Enforcement Point (PEP) to sever the data plane session. Valid user credentials do not override compromised endpoint security posture.

Step-by-Step Solution

1
Analyze the change in security posture during an active session
The workstation's endpoint integrity baseline degraded mid-session due to unauthorized local modification.
Zero Trust requires continuous monitoring of device hygiene alongside identity state.
2
Evaluate the architectural responsibilities of the control plane (PDP and PEP)
The Policy Decision Point (PDP) processes incoming risk signals and computes a dynamic trust score, while the Policy Enforcement Point (PEP) executes the policy enforcement by dropping or allowing data plane traffic.
Separation of control plane logic from data plane enforcement allows real-time adaptive access controls.
3
Determine the proper Zero Trust operational response
The PDP must immediately invalidate session access rights based on reduced trust score and order the PEP to drop the connection.
Implicit trust is never granted based solely on unexpired identity tokens or initial authentication.

Key Concept

Continuous verification and dynamic policy decision making (PDP/PEP) in Zero Trust Architecture
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic