Examkin

Question

Difficulty: HardZero Trust Architecture Principles

An enterprise financial services organization is redesigning its hybrid cloud infrastructure to transition from a legacy perimeter security model to a Zero Trust Architecture (ZTA). The security architecture team must define mandatory implementation standards that adhere strictly to NIST SP 800-207 Zero Trust tenets. Which of the following architectural requirements must be enforced to align with Zero Trust principles? (Select TWO.)

  1. Decouple Policy Decision Point (PDP) logic from Policy Enforcement Points (PEPs) to evaluate continuous contextual telemetry before granting resource access.Answer
  2. Enforce explicit per-session authorization and microsegmentation for all resource requests, treating internal network traffic with the same baseline distrust as external traffic.Answer
  3. C
    Grant implicit trust to authenticated user sessions once initial multi-factor authentication succeeds at the corporate VPN firewall.
  4. D
    Treat successful identity authentication at login as sufficient authorization to access all internal enterprise data plane resources for the session duration.

Answer

The correct architectural requirements are decoupling the Policy Decision Point from Policy Enforcement Points to evaluate dynamic contextual telemetry, and enforcing explicit per-session authorization with microsegmentation across all network traffic.
Zero Trust Architecture relies on continuous verification and explicit authorization for every resource request regardless of network position. Decoupling the Policy Decision Point (PDP) from Policy Enforcement Points (PEPs) ensures central, dynamic policy decisions driven by continuous telemetry, while microsegmentation and per-session validation enforce granular control across all enterprise environments.

Step-by-Step Solution

1
Analyze core Zero Trust Architecture principles
Identified tenets including assumed breach, explicit verification, continuous authentication, dynamic policy evaluation, and microsegmentation.
Zero Trust rejects implicit trust based on network position or single point-in-time authentication.
2
Evaluate control plane architectural components
Confirmed that the Policy Decision Point must dynamically process endpoint telemetry and enterprise policy, instructing Policy Enforcement Points to grant or restrict granular resource access.
Separating policy decision logic from policy enforcement enables adaptive access management.
3
Differentiate Zero Trust controls from legacy perimeter assumptions
Disqualified options that assume internal network safety or treat initial authentication as permanent authorization for a session.
Initial VPN authentication or perimeter location cannot confer implicit trust in a Zero Trust model.

Key Concept

Zero Trust Architecture Principles and Component Roles (PDP/PEP)
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic