Examkin

Question

Difficulty: MediumZero Trust Architecture Principles

A regional energy provider is transitioning its remote field maintenance operations to a Zero Trust Architecture (ZTA). Previously, field technicians authenticated once via Multi-Factor Authentication (MFA) to establish a Virtual Private Network (VPN) session, granting them unrestricted access to internal grid management servers for their entire shift. To align with core Zero Trust principles and eliminate implicit trust, which of the following architectural changes should the security team implement?

  1. Implement a Policy Decision Point (PDP) that continuously evaluates device security posture and request context before a Policy Enforcement Point (PEP) grants access to individual resources.Answer
  2. B
    Require field technicians to re-authenticate at the VPN perimeter gateway using hardware tokens every four hours to automatically extend network segment authorization.
  3. C
    Consolidate technician credentials into a central directory service so that successful identity authentication automatically grants static authorization across all internal subnets.
  4. D
    Deploy perimeter web application firewalls to filter malicious payloads from external networks before traffic reaches internal field maintenance portals.

Answer

Implement a Policy Decision Point (PDP) that continuously evaluates device security posture and request context before a Policy Enforcement Point (PEP) grants access to individual resources.
The correct option aligns directly with Zero Trust Architecture (ZTA) by removing implicit network trust. In a ZTA framework (such as NIST SP 800-207), access to individual resources is evaluated on a per-request basis by a Policy Decision Point (PDP) using continuous contextual telemetry (such as device compliance, location, and user identity), and enforced at a Policy Enforcement Point (PEP).

Step-by-Step Solution

1
Identify the primary architectural flaw in the existing legacy setup.
The legacy VPN grants implicit network-wide trust after a single perimeter authentication event.
Legacy perimeter security assumes internal traffic is trustworthy once initial authentication succeeds.
2
Apply core Zero Trust Architecture (ZTA) principles (NIST SP 800-207).
Zero Trust mandates explicit verification, least privilege, assumed breach, and continuous per-request evaluation.
Access decisions must rely on dynamic trust criteria rather than physical or virtual network position.
3
Select the component implementation that enforces dynamic policy evaluation and enforcement.
The Policy Decision Point (PDP) evaluates contextual signals (device posture, user identity, threat intelligence) and directs the Policy Enforcement Point (PEP) to allow or block access to specific work workloads.
Decoupling policy decision from enforcement ensures dynamic continuous authorization without implicit trust.

Key Concept

Zero Trust Architecture Principles
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic