Examkin

Zero Trust Architecture Principles

45 questions

All types45Multiple choice22Multiple select13Matching10
Question 1Question →

A security administrator is drafting baseline policies to align the enterprise network with Zero Trust Architecture (ZTA) principles. Which of the following fundamental tenets should be included in these guidelines? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Explicitly verify the identity, context, and security posture of every access request regardless of user location.; Enforce least privilege access by restricting user permissions to only the specific resources required for their role.

Answer

The correct answers are the principles of explicit verification of all requests and enforcing least privilege access.
Zero Trust Architecture operates on the core philosophy of 'Never Trust, Always Verify'. This entails explicitly authenticating and authorizing every request regardless of origin, and applying least privilege access controls to limit potential damage from compromised accounts or assets.

Step-by-Step Solution

1
Identify core Zero Trust Architecture (ZTA) principles.
ZTA relies on foundational tenets including 'Never Trust, Always Verify', explicit verification, least privilege, and assumed breach.
Establishing accurate baseline policies requires distinguishing Zero Trust tenets from legacy perimeter defenses.
2
Evaluate the option regarding explicit verification.
Verifying identity, device posture, and context for all access requests regardless of location directly reflects the 'Explicitly Verify' tenet.
Zero Trust eliminates implicit trust based on network location.
3
Evaluate the option regarding least privilege access.
Restricting permissions to only necessary resources directly aligns with the 'Least Privilege' tenet.
Limiting access reduces the blast radius of potential security compromises.

Key Concept

Core Tenets of Zero Trust Architecture
Question 2Question →

A biotechnology enterprise is updating its network security posture to protect cloud-hosted genomic research databases accessed by remote scientists. The organization intends to implement Zero Trust Architecture (ZTA) principles to replace legacy perimeter defenses. Which of the following requirements must be implemented to align with core Zero Trust tenets? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Explicitly verify user identity, device security posture, and transaction context for every resource request, regardless of origin network location.; Enforce microsegmentation and dynamic access policies that restrict permissions strictly to the specific resources needed for the current task.

Answer

The organization must explicitly verify user identity, device health, and context for every request regardless of location, and enforce microsegmentation with dynamic least-privilege access controls.
Zero Trust Architecture relies on the fundamental principles of explicit verification and least privilege through microsegmentation. The requirement to explicitly verify every access request evaluates user identity, device health, and context dynamically before granting entry. Concurrently, microsegmentation restricts network connectivity to micro-perimeters around specific workloads, containing potential lateral movement.

Step-by-Step Solution

1
Evaluate the core tenets of Zero Trust Architecture regarding network trust boundaries.
Zero Trust assumes the internal network is untrusted and requires explicit verification for every request, rejecting implicit perimeter-based trust models.
Assuming internal network traffic is safe allows compromised accounts or devices to move laterally across resources.
2
Analyze access control granularities required under Zero Trust design principles.
Implementing microsegmentation minimizes attack surfaces by creating isolated logical segments enforced by granular access policies.
Least privilege and microsegmentation ensure users and devices receive only the specific access required for their immediate role.

Key Concept

Zero Trust Architecture Principles
Estimated Time:1m 30s
Question 3Question →

A defense technology organization is implementing Zero Trust Architecture (ZTA) for field operations. Mobile tactical command units must access centralized intelligence databases across untrusted wireless channels. To strictly adhere to Zero Trust principles, the architecture must decouple control plane policy evaluation from data plane enforcement. Which of the following implementations correctly demonstrates this architectural separation?

Show answer & explanation

Answer: A centralized policy engine evaluates real-time device health, user context, and threat intelligence to issue dynamic access decisions, while local gateway proxies inspect and enforce those authorization decisions on incoming data streams.

Answer

The implementation where a centralized policy engine evaluates real-time context and dynamic risk factors to issue access decisions, while local gateway proxies enforce those authorization decisions on data streams.
Decoupling control plane policy decisions from data plane enforcement is a foundational Zero Trust Architecture principle. The centralized engine acts as the Policy Decision Point (PDP), using dynamic trust signals (user identity, device posture, location) to decide access, while the gateway proxy acts as the Policy Enforcement Point (PEP) to grant or drop sessions dynamically.

Step-by-Step Solution

1
Identify the core Zero Trust components required for decoupling control plane evaluation from data plane enforcement.
The control plane is represented by the Policy Decision Point (PDP), while the data plane is represented by the Policy Enforcement Point (PEP).
Zero Trust relies on separate functional components to make access decisions (PDP) and apply those decisions to network traffic (PEP).
2
Evaluate the role of the centralized policy engine versus the local gateway proxy.
The centralized policy engine functions as the PDP by continually assessing trust factors, whereas the inline gateway proxy functions as the PEP by granting or denying individual packet flows.
This guarantees per-request explicit verification without allowing implicitly trusted zones.

Key Concept

Decoupling Policy Decision Points (PDP) from Policy Enforcement Points (PEP) in Zero Trust Architecture
Question 4Question →

A smart manufacturing facility is updating its industrial control network to align with Zero Trust Architecture (ZTA) principles. Currently, field sensor nodes and automated robotic assembly controllers communicate freely within an internal operational technology (OT) network segment once inside the network perimeter. Which of the following architectural modifications best implements the core Zero Trust principle of continuous explicit verification for these device communications?

Show answer & explanation

Answer: Requiring every communication session between sensor nodes and assembly controllers to be dynamically authenticated and authorized based on real-time device health and contextual policy before granting access.

Answer

Requiring every communication session between sensor nodes and assembly controllers to be dynamically authenticated and authorized based on real-time device health and contextual policy before granting access.
Zero Trust Architecture fundamentally operates under the principle of 'never trust, always verify.' Requiring every connection request between internal devices to be explicitly authenticated and authorized using dynamic contextual attributes ensures that network location alone never grants implicit access rights.

Step-by-Step Solution

1
Identify current architecture security flaws
The current setup relies on implicit trust within the internal OT network perimeter.
Perimeter-based models assume internal network traffic is inherently safe once inside, leaving systems vulnerable to lateral movement.
2
Apply Zero Trust Architecture tenets
Zero Trust mandates explicit verification and continuous evaluation of every access request regardless of network placement.
Under Zero Trust, access decisions must be dynamic, continuous, and based on contextual identity and asset health metrics.
3
Select the control that enforces dynamic session evaluation
Enforcing real-time, policy-driven authentication and authorization per session fulfills the explicit verification requirement.
This eliminates implicit network location trust and forces granular, continuous validation for every transaction.

Key Concept

Zero Trust Explicit Verification and Continuous Authentication
Question 5Question →

An organization is transitioning from a traditional perimeter-based security model to a Zero Trust Architecture (ZTA). Which of the following fundamental principles must the organization implement as part of this new architectural framework? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assume all network traffic is untrusted, even if originating within the internal network.; Perform explicit verification for every access request using dynamic identity, context, and policy evaluation.

Answer

The correct principles are assuming all network traffic is untrusted regardless of origin and explicitly verifying every access request using dynamic context and policy evaluation.
Zero Trust Architecture replaces legacy boundary-based trust with two foundational tenets: assuming that network traffic is inherently untrusted regardless of source location ('assume breach'), and enforcing explicit verification on every access request using identity, context, and policy evaluation.

Step-by-Step Solution

1
Identify the foundational trust model of Zero Trust Architecture.
Zero Trust operates under an 'assume breach' philosophy.
Internal network traffic can no longer be assumed secure simply because it originates behind a perimeter firewall.
2
Determine the required access evaluation process.
Every request must undergo explicit verification before access is granted.
Verification must continuously consider user identity, device security posture, and request context.

Key Concept

Zero Trust Core Tenets: Assume Breach and Explicit Verification
Question 6Question →

A network security technician is configuring access controls for a healthcare portal. The technician establishes a system that continuously authenticates user identity, validates device compliance, and evaluates permissions for every resource request, even when traffic originates from within the internal corporate network. Which core principle of Zero Trust Architecture is directly demonstrated by this implementation?

Show answer & explanation

Answer: Explicit verification of every access request regardless of network location

Answer

Explicit verification of every access request regardless of network location
The correct answer highlights explicit verification, which is a foundational tenet of Zero Trust Architecture requiring that all access requests be authenticated, authorized, and continuously validated regardless of where the request originates.

Step-by-Step Solution

1
Analyze the access control scenario requirements
Identified continuous authentication, device status checking, and per-request authorization both inside and outside the corporate network.
Understanding the operational behavior helps align it with foundational architectural principles.
2
Evaluate against Zero Trust Architecture core tenets
The requirement to verify every user, device, and request continuously aligns directly with 'explicit verification' ('never trust, always verify').
Zero Trust mandates removing implicit trust tied to internal IP addresses or network perimeters.

Key Concept

Zero Trust Explicit Verification
Estimated Time:45s
Question 7Question →

Match each Zero Trust Architecture (ZTA) functional component on the left with its corresponding operational role on the right.

Click a left item, then click its matching right item

Items

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)
Data Plane

Matches

Show answer & explanation

Answer

Policy Engine matches with evaluating security policies and context; Policy Administrator matches with issuing control commands to manage connections; Policy Enforcement Point matches with intercepting traffic and enforcing access controls; Data Plane matches with carrying actual application payload traffic.
Each Zero Trust architecture component serves a distinct role split across the control plane and data plane. The Policy Engine (PE) evaluates policies and context to determine authorization. The Policy Administrator (PA) generates signals and credentials to open or close sessions. The Policy Enforcement Point (PEP) acts as the inline mechanism enforcing access. The Data Plane carries the actual payload once allowed.

Step-by-Step Solution

1
Identify the decision-making brain of Zero Trust Architecture.
The Policy Engine (PE) processes rules and context to make authorization decisions.
ZTA relies on dynamic evaluation of trust before access is decided.
2
Identify the control signaling component.
The Policy Administrator (PA) executes decision commands to control connection establishment.
PA coordinates between the decision engine and enforcement mechanisms.
3
Identify the inline gatekeeper component.
The Policy Enforcement Point (PEP) directly inspects and controls subject access requests.
Enforcement must happen directly at the gateway or endpoint interface.
4
Identify the network layer responsible for user payload.
The Data Plane transports application user data separate from control signals.
NIST SP 800-207 mandates separation between the control plane and data plane.

Key Concept

Zero Trust Functional Components (NIST SP 800-207)
Question 8Question →

A financial enterprise security team mandates that every access request to sensitive payment processing services must be explicitly authenticated, authorized, and encrypted, regardless of whether the request originates from an internal office workstation or a remote home connection. Which core principle of Zero Trust Architecture does this policy directly demonstrate?

Show answer & explanation

Answer: Explicit verification of every access request regardless of user location or network origin

Answer

Explicit verification of every access request regardless of user location or network origin
Zero Trust Architecture operates on the fundamental principle of explicit verification ('never trust, always verify'). Every access request must be continuously authenticated, authorized, and encrypted using all available context (such as user identity, location, device health, and data sensitivity) regardless of whether the request originates inside or outside the traditional corporate network.

Step-by-Step Solution

1
Analyze the enterprise security requirement described in the stem.
The policy requires strict authentication, authorization, and encryption for every single connection attempt, treating internal and external network locations identically.
Identifying the operational boundary and access conditions enforced by the policy.
2
Map the requirement to established Zero Trust Architecture tenets.
The requirement directly aligns with the foundational Zero Trust principle of explicit verification ('never trust, always verify').
Zero Trust eliminates implicit trust based on network topology or user location.

Key Concept

Zero Trust Explicit Verification Tenet
Question 9Question →

An organization is deploying Zero Trust Architecture (ZTA) across its network infrastructure. When an employee attempts to access a sensitive human resources portal, which functional component is responsible for evaluating the user's identity, device posture, and enterprise policies to determine whether access should be granted?

Show answer & explanation

Answer: Policy Decision Point (PDP)

Answer

Policy Decision Point (PDP)
The Policy Decision Point (PDP) serves as the logical brain in Zero Trust Architecture. It evaluates access requests against organizational security rules, user attributes, device health, and environmental signals to decide whether access should be allowed or denied.

Step-by-Step Solution

1
Analyze the role required in the scenario
The scenario asks for the component that evaluates policies and contextual signals to make an access determination.
Zero Trust separates policy decision-making from policy enforcement.
2
Map the required functionality to standard Zero Trust architecture components
The Policy Decision Point (PDP) processes input signals against security policies to yield an access decision, whereas the Policy Enforcement Point (PEP) applies that decision to the data connection.
Identifying the PDP as the decision-making brain distinguishes it from enforcement mechanisms.

Key Concept

Policy Decision Point (PDP) in Zero Trust Architecture
Estimated Time:45s
Question 10Question →

An enterprise cloud application utilizes a service mesh architecture to handle communication between internal microservices. To reduce authentication overhead and improve performance, a DevOps engineer proposes issuing a persistent session token after an initial mTLS handshake, allowing subsequent microservice calls to bypass per-request authorization checks. Which of the following statements best explains why this proposed design violates core Zero Trust Architecture principles?

Show answer & explanation

Answer: It creates implicit trust within the internal communications boundary by assuming prior authentication remains valid for subsequent transactions without continuous verification.

Answer

The proposed design violates Zero Trust Architecture principles because it establishes implicit trust across subsequent requests within the service mesh by assuming prior authentication remains valid without continuous per-request evaluation.
Zero Trust Architecture (ZTA) mandates that no implicit trust is granted based on past authentication or internal network positioning. Every transaction and inter-service call must be individually evaluated and authorized continuously in real time using contextual signals.

Step-by-Step Solution

1
Analyze the core proposal in the scenario.
The engineer proposes issuing a persistent session token after an initial mTLS handshake to bypass authorization for subsequent calls.
Identifying the mechanism helps determine which architectural security boundary or tenet is being altered.
2
Evaluate the proposal against Zero Trust Architecture (ZTA) core tenets (e.g., NIST SP 800-207).
ZTA dictates that all resource access must be explicitly verified and dynamically authorized on a per-request basis regardless of network location or previous authentication states.
Zero Trust operates under the premise of 'never trust, always verify' and assumes the internal network is always compromised.
3
Identify the primary architectural failure in the proposal.
Bypassing per-request authorization grants implicit trust to subsequent requests based on state stored from a past check, directly violating the continuous verification tenet.
Allowing persistent trust without evaluating real-time context on every request creates an attack window if a session token or microservice is compromised.

Key Concept

Continuous Explicit Verification and Elimination of Implicit Trust in Zero Trust Architecture
Estimated Time:2m 30s
Question 11Question →

Match each Zero Trust Architecture principle on the left with its corresponding operational description on the right.

Click a left item, then click its matching right item

Items

Explicit Verification
Least Privilege Access
Assume Breach
Microsegmentation

Matches

Show answer & explanation

Answer

Explicit Verification matches authenticating and authorizing every access request based on identity and context; Least Privilege Access matches limiting user rights using JIT and JEA controls; Assume Breach matches operating under the premise that internal systems are compromised; Microsegmentation matches dividing network environments into granular zones to restrict lateral movement.
Each Zero Trust principle accurately maps to its operational definition: Explicit Verification dynamically validates requests; Least Privilege Access enforces minimal permissions; Assume Breach plans for internal compromise; Microsegmentation prevents lateral network movement.

Step-by-Step Solution

1
Identify the concept requiring continuous authentication and contextual authorization for every transaction.
Explicit Verification aligns with validating identity, location, and device status dynamically.
Zero Trust eliminates implicit trust based on network location, mandating explicit validation.
2
Identify the concept designed to restrict user permissions to minimum necessary levels.
Least Privilege Access aligns with implementing JIT (Just-In-Time) and JEA (Just-Enough-Access) controls.
Restricting permissions minimizes potential exposure if credentials are compromised.
3
Identify the architectural mindset assuming active compromise within internal perimeters.
Assume Breach aligns with operating under internal compromise conditions and encrypting all traffic.
Assuming breach forces organizations to contain blast radius and continuously inspect internal communications.
4
Identify the network design strategy used to isolate workloads and stop internal spread.
Microsegmentation aligns with creating granular network boundaries.
Microsegmentation prevents lateral movement across internal subnets and applications.

Key Concept

Core principles and operational tenets of Zero Trust Architecture
Question 12Question →

An enterprise architecture team is designing a NIST SP 800-207 compliant Zero Trust solution to enforce dynamic control plane and data plane boundaries across hybrid environments. Pair each Zero Trust logical component on the left with its precise operational function on the right.

Click a left item, then click its matching right item

Items

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)
Continuous Diagnostics and Mitigation (CDM) System

Matches

Show answer & explanation

Answer

Policy Engine (PE) matches with applying enterprise trust algorithms to determine access decisions; Policy Administrator (PA) matches with executing governance decisions by issuing control commands or credentials to manage the connection path; Policy Enforcement Point (PEP) matches with operating in the data plane to intercept traffic and enforce connection states; Continuous Diagnostics and Mitigation (CDM) System matches with continuously gathering asset health metrics to feed real-time compliance inputs.
In NIST SP 800-207 Zero Trust Architecture, logical responsibilities are strictly separated between decision-making, administration, enforcement, and environmental telemetry. The Policy Engine evaluates trust algorithms to decide access; the Policy Administrator signals session establishment or teardown; the Policy Enforcement Point intercepts data plane traffic to enforce session commands; and the Continuous Diagnostics and Mitigation System provides real-time posture feeds to dynamically reassess trust.

Step-by-Step Solution

1
Differentiate control plane components from data plane components in NIST SP 800-207 Zero Trust Architecture.
Identified Policy Engine and Policy Administrator as control plane entities (PDP), PEP as data plane boundary, and CDM as an external security input source.
Establishing plane separation is required to evaluate structural roles.
2
Differentiate the decision component from the execution component within the control plane.
The Policy Engine evaluates rules to make access decisions, whereas the Policy Administrator commands session creation or termination.
Conflating PE and PA roles is a common architectural error.
3
Identify the data plane component responsible for inline enforcement.
The Policy Enforcement Point directly intercepts subject traffic and enforces PA instructions.
The PEP is the only component listed that resides directly in the traffic flow path.
4
Identify the contextual state feed component.
The CDM System monitors device health, vulnerability data, and patch state to provide continuous diagnostic inputs to the PE.
Zero Trust decisions require real-time dynamic trust scoring provided by CDM telemetry.

Key Concept

NIST SP 800-207 Zero Trust Architecture Components and Control/Data Plane Separation
Question 13Question →

An organization is updating its enterprise security strategy to align with Zero Trust Architecture (ZTA) principles. Which of the following implementations best demonstrates the core Zero Trust tenet of "assume breach"?

Show answer & explanation

Answer: Encrypting all network communications and enforcing microsegmentation regardless of user or device location

Answer

Encrypting all network communications and enforcing microsegmentation regardless of user or device location
The core Zero Trust tenet of 'assume breach' requires organizations to plan defenses as if attackers already have access to the internal network. Encrypting internal communications and implementing microsegmentation ensures that even if an internal host is compromised, lateral movement and unauthorized data interception are strictly controlled.

Step-by-Step Solution

1
Identify the key tenet being evaluated
The core tenet is 'assume breach', which presumes attackers may already be inside the network environment.
Zero Trust assumes no implicit trust based solely on physical or network location.
2
Evaluate the architectural control that minimizes blast radius during a compromise
Microsegmentation and end-to-end encryption ensure lateral movement is prevented and data remains protected even if an internal host is compromised.
This continuously enforces strict access boundaries and limits exposure during an incident.

Key Concept

Assume Breach in Zero Trust Architecture
Estimated Time:45s
Question 14Question →

A system administrator is updating an enterprise security policy to align with core Zero Trust Architecture (ZTA) principles. Which of the following practices represent core tenets of Zero Trust? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Explicitly verify identity, device health, and context for every access request; Enforce least privilege access by restricting user permissions to only what is necessary for specific tasks

Answer

The core tenets of Zero Trust Architecture include explicitly verifying every access request and enforcing least privilege access controls.
Zero Trust Architecture enforces continuous explicit verification for all access requests and limits user rights through least privilege access policies to minimize risk.

Step-by-Step Solution

1
Identify core Zero Trust Architecture tenets
Zero Trust is built on the philosophy of 'never trust, always verify', assuming that threats exist both outside and inside the network.
Traditional perimeter defenses rely on implicit trust, which Zero Trust explicitly replaces with continuous verification.
2
Evaluate the requirement for verification
Explicit verification mandates that all requests are authenticated, authorized, and validated based on user identity, location, device health, and data classification.
This prevents unauthorized movement even if an attacker gains entry to the network.
3
Evaluate the requirement for access restriction
Least privilege access limits user access with Just-In-Time (JIT) and Just-Enough-Access (JEA) policies.
Restricting access reduces the blast radius in the event of a credential compromise.

Key Concept

Zero Trust Architecture Principles
Question 15Question →

An autonomous manufacturing enterprise is transitioning its edge-compute microservices and industrial IoT telemetry pipeline to a Zero Trust Architecture (ZTA). A security architect must define control plane and data plane operational requirements to enforce core Zero Trust tenets across all component communications.

Which of the following architectural requirements MUST be implemented to strictly align with Zero Trust Architecture principles? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Dynamically evaluate device health, user identity, and contextual risk attributes at the Policy Decision Point (PDP) for every transaction before authorizing access.; Enforce mutual TLS (mTLS) and continuous re-authorization for all inter-service communications regardless of physical or logical network location.

Answer

The correct requirements are dynamically evaluating device health, identity, and contextual risk at the Policy Decision Point for every transaction, and enforcing mutual TLS with continuous re-authorization across all inter-service communications regardless of network location.
Zero Trust Architecture strictly mandates explicit verification and continuous evaluation. Requiring the Policy Decision Point (PDP) to dynamically evaluate posture, identity, and risk metrics for every transaction ensures access decisions reflect real-time threat contexts. Furthermore, enforcing mutual TLS (mTLS) and continuous re-authorization across all inter-service communications aligns with the assumed breach paradigm, eliminating implicit trust based on network topology.

Step-by-Step Solution

1
Identify core Zero Trust Architecture tenets regarding request evaluation.
Zero Trust requires explicit verification per transaction using dynamic telemetry (identity, posture, environmental risk) handled by the Policy Decision Point (PDP).
Implicit trust is eliminated; authentication and authorization are contextual and continuous rather than static or location-based.
2
Analyze data plane network communication controls under Zero Trust.
All traffic must be secured end-to-end (e.g., using mTLS) and continuously re-verified at Policy Enforcement Points (PEPs) closest to the resources.
The underlying network is assumed compromised, necessitating microsegmentation and continuous session validation regardless of physical VLAN or subnet position.
3
Evaluate and eliminate perimeter-reliance misconceptions.
Reject options proposing post-authentication implicit trust zones or reliance on centralized perimeter firewalls in place of PEPs.
Legacy perimeter security fails to protect against lateral movement and violates the assumed breach tenet of Zero Trust.

Key Concept

Zero Trust Architecture Principles: Explicit Verification, Continuous Authentication, Assumed Breach, and Microsegmentation
Question 16Question →

A logistics enterprise is migrating its fleet tracking telemetry infrastructure to a Zero Trust Architecture (ZTA). The security team is defining architecture baseline policies for API communication between edge gateway devices and core analytical microservices. Which of the following technical requirements directly align with core Zero Trust Architecture principles? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Continuously re-evaluate device security posture and request behavior for every API transaction, regardless of network location.; Enforce microsegmentation and dynamic access controls so edge devices are restricted to the minimal resources necessary for their specific function.

Answer

The correct requirements are to continuously re-evaluate device security posture and request behavior for every API transaction regardless of network location, and to enforce microsegmentation and dynamic access controls so edge devices are restricted to the minimal resources necessary for their specific function.
Zero Trust Architecture (ZTA) eliminates implicit network perimeter trust by mandating continuous explicit verification of every transaction (evaluating security posture, location, and behavior) and applying least privilege through microsegmentation to isolate workloads and minimize blast radius.

Step-by-Step Solution

1
Analyze core tenets of Zero Trust Architecture (ZTA).
ZTA operates under an assumed breach mindset, requiring continuous explicit verification and strict least privilege.
Traditional perimeter-based implicit trust models must be abandoned in favor of dynamic context evaluation.
2
Evaluate requirement for continuous context validation.
Every API request must be continuously authenticated and authorized based on dynamic context metrics.
Re-evaluating posture and request behavior prevents compromised endpoints from abusing persistent session trust.
3
Evaluate requirement for microsegmentation and least privilege access.
Access must be restricted granularly to only the exact microservice endpoints required for the gateway's role.
Microsegmentation prevents lateral movement across microservices if an edge device is compromised.

Key Concept

Zero Trust Architecture Principles: Continuous Explicit Verification and Microsegmentation Least Privilege
Question 17Question →

A fintech enterprise is restructuring its cloud-native microservices architecture to mitigate risks associated with lateral movement after a compromised service credential allowed unauthorized database queries. The security engineering team must align service-to-service communication with core Zero Trust Architecture (ZTA) principles. Which implementation strategy best enforces the Zero Trust principles of explicit verification and dynamic access control for every transaction request?

Show answer & explanation

Answer: Configuring the Policy Decision Point (PDP) to continuously evaluate identity attributes, contextual threat intelligence, and resource compliance state before issuing per-request authorization decisions to the Policy Enforcement Point (PEP).

Answer

Configuring the Policy Decision Point (PDP) to continuously evaluate identity attributes, contextual threat intelligence, and resource compliance state before issuing per-request authorization decisions to the Policy Enforcement Point (PEP).
In a Zero Trust Architecture (ZTA), access decisions are never granted implicitly based on network location or initial login state. Instead, the Policy Decision Point (PDP) continuously evaluates contextual attributes (such as service identity, device compliance, telemetry, and threat risk) for every request, instructing the Policy Enforcement Point (PEP) to enforce fine-grained access control.

Step-by-Step Solution

1
Analyze the core architectural requirements of Zero Trust Architecture (NIST SP 800-207 framework).
Zero Trust requires explicit verification of every access attempt, continuous risk assessment, least privilege access, and strict separation between the control plane and data plane.
Implicit trust based on network location or session duration must be eliminated to prevent lateral movement.
2
Differentiate between the functional roles of the Policy Decision Point (PDP) and Policy Enforcement Point (PEP).
The PDP acts in the control plane to evaluate policy parameters (user identity, device health, risk score, context) and generates authorization decisions. The PEP acts in the data plane to allow or block individual communication flows based on PDP directives.
Decoupling policy computation from traffic forwarding ensures granular, dynamic, and centrally managed security enforcement.
3
Evaluate the choices against Zero Trust tenets.
Evaluating identity attributes and contextual posture per-request via the PDP to instruct the PEP is the only strategy that eliminates implicit perimeter trust and enforces explicit per-request verification.
Options relying on subnet trust, long-lived session tokens, or pure anomaly detection fail to implement dynamic, identity-centric access control.

Key Concept

Zero Trust Architecture Control Plane Separation and Continuous Explicit Verification
Estimated Time:2m 0s
Question 18Question →

An enterprise security architect is categorizing control plane and data plane functional duties during a Zero Trust Architecture (ZTA) migration. Match each Zero Trust architecture component on the left with its specific operational responsibility on the right.

Click a left item, then click its matching right item

Items

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)
Threat Intelligence System

Matches

Show answer & explanation

Answer

The Policy Engine renders access authorization decisions; the Policy Administrator commands control plane session establishment or teardown; the Policy Enforcement Point gates data plane traffic; and the Threat Intelligence System supplies contextual threat data to dynamic trust scoring processes.
In Zero Trust Architecture (NIST SP 800-207), the control plane is split into evaluation logic (Policy Engine) and control execution (Policy Administrator), which together make up the Policy Decision Point (PDP). The Policy Enforcement Point (PEP) resides in the data plane to directly gate resource access. External contextual providers, such as Threat Intelligence Systems, supply real-time attack data to inform dynamic trust decisions.

Step-by-Step Solution

1
Differentiate between Policy Decision Point (PDP) components and Policy Enforcement Point (PEP) locations.
Identified the Policy Engine and Policy Administrator as core PDP components in the control plane, while the PEP functions strictly within the data plane boundary.
ZTA relies on a clear operational separation between control plane decision logic and data plane traffic enforcement.
2
Distinguish between the decision logic (PE) and the execution logic (PA) within the PDP.
Matched the Policy Engine to policy calculation and access decision rendering, and the Policy Administrator to signaling the PEP to open or close session channels.
The PE evaluates contextual inputs against trust algorithms, whereas the PA communicates decision outcomes to enforcement gates.
3
Map supporting data sources to their external telemetry role.
Associated the Threat Intelligence System with providing real-time external threat feeds and dynamic risk context.
Continuous authorization relies on contextual data sources outside standard static identity attributes.

Key Concept

Zero Trust Control Plane vs. Data Plane Component Functions (NIST SP 800-207)
Question 19Question →

An aerospace engineering organization has implemented Zero Trust Architecture (ZTA) controls for engineers accessing proprietary CAD schematics stored in a hybrid cloud repository. During an active remote session from a corporate laptop, the security monitoring system detects that the local endpoint protection agent was disabled and the asset's dynamic risk score surged. Although the engineer successfully completed multi-factor authentication (MFA) at session initiation, access to the repository is revoked instantly. Which Zero Trust Architecture core principle is directly demonstrated by this access enforcement action?

Show answer & explanation

Answer: Continuous verification and dynamic risk assessment throughout the session lifecycle

Answer

Continuous verification and dynamic risk assessment throughout the session lifecycle
The scenario demonstrates immediate access termination when a client device's security posture degrades mid-session. Under Zero Trust Architecture principles, explicit verification must occur continuously rather than once at initial authentication. Policy Decision Points (PDPs) evaluate real-time contextual signals—such as endpoint health, user risk score, and system compliance—to adjust or revoke access dynamically throughout the connection lifecycle.

Step-by-Step Solution

1
Analyze the access control trigger and response described in the scenario.
Access was granted following MFA, but was dynamically terminated mid-session due to host security posture degradation (disabled protection agent and spiked risk score).
Understanding why access was altered mid-session identifies the specific operational policy logic.
2
Evaluate the action against Zero Trust Architecture principles.
Zero Trust dictates that authentication and authorization are never static events; Policy Decision Points (PDPs) must continuously re-evaluate sessions using dynamic context and real-time security signals.
This contrasts with legacy security architectures that assume trusted status after initial authentication.
3
Select the option that accurately describes this architectural behavior.
The concept of continuous verification and dynamic risk assessment throughout the session lifecycle correctly describes immediate revocation upon host posture decay.
It explicitly captures the core ZTA tenet of continuous re-assessment without relying on implicit, persistent session trust.

Key Concept

Continuous Verification and Dynamic Context-Based Access Control
Estimated Time:1m 30s
Question 20Question →

A biomedical research enterprise is migrating its hybrid cloud infrastructure to align with Zero Trust Architecture (ZTA) principles to protect sensitive patient records and proprietary research data. Which of the following architectural strategies MUST the security engineering team implement to strictly enforce Zero Trust principles? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Implement continuous, risk-based session evaluation at the Policy Decision Point (PDP) that dynamically reassesses access grants based on endpoint telemetry and user behavior.; Enforce microsegmentation around individual workload components so that all lateral east-west network traffic is explicitly authenticated, authorized, and encrypted.

Answer

The correct architectural strategies are implementing continuous, risk-based session evaluation at the Policy Decision Point (PDP) using dynamic telemetry, and enforcing microsegmentation around individual workload components so that all lateral east-west traffic is explicitly authenticated, authorized, and encrypted.
Zero Trust Architecture requires continuous explicit verification and strict resource isolation. Implementing dynamic telemetry checks at the Policy Decision Point (PDP) ensures access grants are re-evaluated continuously against current risk state. Enforcing microsegmentation prevents lateral attacker movement by inspecting and authorizing all internal east-west traffic regardless of network location.

Step-by-Step Solution

1
Evaluate Zero Trust core tenets regarding continuous verification and dynamic access control.
Dynamic policy evaluation at the Policy Decision Point (PDP) ensures access permissions dynamically adapt to changes in device posture, threat intelligence, and user risk metrics.
Static initial logins are insufficient; continuous posture and risk assessment are required under Zero Trust principles.
2
Analyze network isolation and segmentation requirements under an assumed breach posture.
Microsegmentation restricts lateral movement by requiring explicit authorization and encryption for all internal workloads, treating all east-west network traffic as un-trusted.
Perimeter defenses and legacy VPNs grant implicit trust once inside, which contradicts Zero Trust requirements.

Key Concept

Zero Trust Architecture Principles: Continuous Verification, Microsegmentation, and Explicit Access Controls
Page 1 / 3Next
Zero Trust Architecture Principles Practice Questions — CompTIA Security+ | Examkin