Examkin

Soru

Zorluk: OrtaZero Trust Architecture Principles

A regional healthcare network is redesigning its infrastructure to align with Zero Trust Architecture (ZTA) principles for biomedical IoT equipment, such as infusion pumps and vital sign monitors. Historically, once a biomedical device successfully completed initial 802.1X authentication on an internal switch port, it was granted persistent trust and unmonitored network access to servers containing electronic health records (EHR). Which of the following implementations best fulfills the Zero Trust requirement for resource access control in this scenario?

  1. Positioning a Policy Enforcement Point (PEP) to gate all access requests and dynamically enforce decisions made by the Policy Engine based on continuous assessment of device state and context.Cevap
  2. B
    Configuring core network switches to automatically grant full internal network trust to any MAC address that completes port-level authentication successfully.
  3. C
    Issuing long-lived client certificates to devices so initial identity verification grants perpetual authorization for all subsequent API requests.
  4. D
    Deploying signature-based network intrusion prevention rules at the perimeter firewall to inspect incoming external web traffic.

Cevap

Positioning a Policy Enforcement Point (PEP) to gate all access requests and dynamically enforce decisions made by the Policy Engine based on continuous assessment of device state and context.
The core tenets of Zero Trust Architecture (as defined in NIST SP 800-207) mandate that all communication is secured regardless of network location, access to resources is granted on a per-session basis, and access rights are determined dynamically by a Policy Engine and enforced by a Policy Enforcement Point (PEP). Implementing a PEP to gate resource requests based on continuous evaluation of device health and context fulfills these requirements.

Adım Adım Çözüm

1
Analyze the legacy architecture vulnerability in the scenario.
The current model relies on implicit trust following an initial port-level authentication check.
Zero Trust assumes breach and dictates that no device or traffic flow should be implicitly trusted based on its network location or prior authentication.
2
Evaluate Zero Trust Architecture architectural components (NIST SP 800-207).
Access decisions must be evaluated by a Policy Engine/Policy Administrator (Policy Decision Point) and enforced per request by a Policy Enforcement Point (PEP).
Every resource request must be explicitly verified, evaluating device posture, user context, and transaction threat level before granting access.
3
Identify the option that enforces continuous explicit verification and PEP placement.
The approach placing a PEP to gate requests based on dynamic evaluation by the Policy Engine directly aligns with ZTA requirements.
This guarantees microsegmentation, explicit verification, and continuous risk assessment.

Anahtar Kavram

Zero Trust Policy Decision Point (PDP) and Policy Enforcement Point (PEP) Architecture
Bu soruyu puanla

Konular

Zero Trust Architecture Principles

Bu konudan daha fazla soru