Examkin

Question

Difficulty: MediumZero Trust Architecture Principles

A corporate employee working remotely authenticates successfully at the start of their shift using multi-factor authentication (MFA) from a compliant corporate laptop. Mid-day, a local policy check detects that the endpoint antivirus service was forcibly stopped and an unauthorized storage device was attached. Under Zero Trust Architecture (ZTA) principles, how should the access control system respond to this change in device posture?

  1. A
    Maintain the active session uninterrupted because identity verification was completed successfully during morning authentication.
  2. B
    Allow internal network traffic to proceed unrestricted while generating an informational syslog event at the boundary firewall.
  3. Dynamically re-evaluate security context and immediately revoke or restrict active application access privileges.Answer
  4. D
    Reclassify the perimeter firewall from a corrective control to a detective control to monitor ongoing endpoint traffic.

Answer

Dynamically re-evaluate security context and immediately revoke or restrict active application access privileges.
Zero Trust Architecture enforces continuous verification and explicit validation. Under ZTA, access is never implicitly granted permanently based on initial authentication. When device posture changes (such as disabling security agents or introducing high-risk hardware), the policy engine must dynamically re-evaluate the risk score and instruct policy enforcement points to revoke or constrain active session access immediately.

Step-by-Step Solution

1
Identify the core security event described in the enterprise scenario.
An authenticated endpoint underwent a negative change in security posture due to a disabled security service and unapproved hardware connection.
Understanding the trigger condition is essential to determine how access decisions must adapt.
2
Apply Zero Trust Architecture (ZTA) principles to the context evaluation.
Zero Trust assumes no implicit trust based on network location or past successful login, mandating explicit and continuous verification of context, identity, and device health.
Static initial authentication does not grant permanent access when operational risk parameters change.
3
Select the appropriate enforcement mechanism based on continuous inspection.
The architecture must dynamically adjust session state, revoking or step-down restricting access until compliance state is remediated.
Real-time context evaluation ensures access decisions react instantaneously to endpoint security degradation.

Key Concept

Continuous Verification and Dynamic Access Control in Zero Trust Architecture
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic