Examkin

Soru

Zorluk: Çok zorZero Trust Architecture Principles

An enterprise cloud application utilizes a service mesh architecture to handle communication between internal microservices. To reduce authentication overhead and improve performance, a DevOps engineer proposes issuing a persistent session token after an initial mTLS handshake, allowing subsequent microservice calls to bypass per-request authorization checks. Which of the following statements best explains why this proposed design violates core Zero Trust Architecture principles?

  1. It creates implicit trust within the internal communications boundary by assuming prior authentication remains valid for subsequent transactions without continuous verification.Cevap
  2. B
    It shifts Policy Decision Point (PDP) functionality directly into the data plane layer rather than isolating trust evaluation logic within the Policy Enforcement Point (PEP).
  3. C
    It relies on transport-layer cryptographic handshakes to validate application privilege levels instead of using identity-aware access tokens.
  4. D
    It assumes inter-service traffic is inherently secure due to perimeter boundary filtering, bypassing inline microsegmentation controls.

Cevap

The proposed design violates Zero Trust Architecture principles because it establishes implicit trust across subsequent requests within the service mesh by assuming prior authentication remains valid without continuous per-request evaluation.
Zero Trust Architecture (ZTA) mandates that no implicit trust is granted based on past authentication or internal network positioning. Every transaction and inter-service call must be individually evaluated and authorized continuously in real time using contextual signals.

Adım Adım Çözüm

1
Analyze the core proposal in the scenario.
The engineer proposes issuing a persistent session token after an initial mTLS handshake to bypass authorization for subsequent calls.
Identifying the mechanism helps determine which architectural security boundary or tenet is being altered.
2
Evaluate the proposal against Zero Trust Architecture (ZTA) core tenets (e.g., NIST SP 800-207).
ZTA dictates that all resource access must be explicitly verified and dynamically authorized on a per-request basis regardless of network location or previous authentication states.
Zero Trust operates under the premise of 'never trust, always verify' and assumes the internal network is always compromised.
3
Identify the primary architectural failure in the proposal.
Bypassing per-request authorization grants implicit trust to subsequent requests based on state stored from a past check, directly violating the continuous verification tenet.
Allowing persistent trust without evaluating real-time context on every request creates an attack window if a session token or microservice is compromised.

Anahtar Kavram

Continuous Explicit Verification and Elimination of Implicit Trust in Zero Trust Architecture
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Zero Trust Architecture Principles

Bu konudan daha fazla soru