Examkin

Soru

Zorluk: OrtaZero Trust Architecture Principles

A software enterprise is redesigning access controls for its third-party developer API integration portal. Currently, after external developers authenticate through a legacy VPN connection, their sessions are implicitly trusted across internal staging systems. The enterprise wants to modernize this architecture to align with Zero Trust Architecture (ZTA) principles. Which of the following strategies best implements Zero Trust for these third-party developer connections?

  1. Deploy a Policy Decision Point (PDP) to continuously evaluate context and device posture, instructing a Policy Enforcement Point (PEP) to grant explicit, minimal access to specific API resources.Cevap
  2. B
    Establish an internal trusted subnet for authenticated developer traffic, bypassing secondary authorization checks after initial VPN verification.
  3. C
    Rely on strong multi-factor authentication at initial session login to automatically authorize all subsequent API endpoints for the duration of the token lifetime.
  4. D
    Install high-throughput perimeter firewalls at the network edge to inspect packet payloads and block malicious traffic targeting backend staging servers.

Cevap

Deploying a Policy Decision Point (PDP) to continuously evaluate context and device posture, instructing a Policy Enforcement Point (PEP) to grant explicit, minimal access to specific API resources.
Zero Trust Architecture relies on explicit verification, continuous dynamic evaluation, and least privilege access. Decoupling access control into a Policy Decision Point (PDP) that dynamically evaluates context (such as identity, threat intelligence, and device health) and directs a Policy Enforcement Point (PEP) to gate resource access embodies core NIST SP 800-207 Zero Trust principles.

Adım Adım Çözüm

1
Analyze current access model limitations
Identified implicit trust after initial VPN authentication as a violation of Zero Trust architecture.
Zero Trust assumes the network is hostile and rejects implicit trust based on network location or past authentication.
2
Identify core Zero Trust control components required for access governance
Determined that access decisions must be separated into a Policy Decision Point (PDP) and enforced via a Policy Enforcement Point (PEP).
NIST SP 800-207 specifies that the PDP evaluates policies continuously while the PEP gates actual resource access.
3
Select the option enforcing continuous verification and least privilege
The architecture using PDP and PEP for continuous contextual authorization fulfills Zero Trust principles.
This strategy ensures every request is explicitly authenticated, authorized, and dynamically evaluated based on risk.

Anahtar Kavram

Zero Trust Architecture Control Plane Decoupling and Continuous Explicit Verification
Bu soruyu puanla

Konular

Zero Trust Architecture Principles

Bu konudan daha fazla soru