ACL Zero Trust Architecture & Microsegmentation 2 — Questions and Answers
Question 1: What is the function of a Policy Decision Point (PDP) in Zero Trust Architecture?
- It encrypts data in transit between network segments
- It evaluates access requests against policies and grants or denies access (Correct answer)
- It monitors network traffic for anomalous behavior patterns
- It manages digital certificates for device authentication
Correct answer: It evaluates access requests against policies and grants or denies access
The Policy Decision Point (PDP) evaluates access requests by comparing them against defined policies, determining whether to grant or deny access before the Policy Enforcement Point acts on that decision.
Question 2: How does microsegmentation differ from traditional VLAN-based network segmentation?
- Microsegmentation operates at Layer 7, while VLANs operate at Layer 2
- Microsegmentation provides workload-level granularity, while VLANs segment at the subnet level (Correct answer)
- Microsegmentation is only applicable to cloud environments, while VLANs work on-premises only
- Microsegmentation requires physical hardware changes, while VLANs are purely software-defined
Correct answer: Microsegmentation provides workload-level granularity, while VLANs segment at the subnet level
Microsegmentation enforces policies at the individual workload or application level, providing far more granular control than VLANs, which segment traffic at the broader network or subnet level.
Question 3: In Zero Trust Architecture, what is 'East-West' traffic?
- Traffic flowing between the data center and remote branch offices
- Traffic moving laterally between servers and services within a data center or cloud (Correct answer)
- Traffic from external users accessing internal web applications
- Traffic between geographically distributed data centers over WAN links
Correct answer: Traffic moving laterally between servers and services within a data center or cloud
East-West traffic refers to lateral traffic moving between internal servers, services, and workloads within a data center or cloud environment, as opposed to North-South traffic entering or leaving the perimeter.
Question 4: Which NIST publication provides the primary framework for implementing Zero Trust Architecture?
- NIST SP 800-53
- NIST SP 800-207 (Correct answer)
- NIST SP 800-171
- NIST SP 800-61
Correct answer: NIST SP 800-207
NIST Special Publication 800-207 is the definitive guide for Zero Trust Architecture, defining its core components, tenets, logical components, and deployment models.
Question 5: What is a Software-Defined Perimeter (SDP) in the context of Zero Trust?
- A physical firewall appliance that enforces network boundaries
- A dynamic, identity-centric access control model that hides infrastructure from unauthorized users (Correct answer)
- A cloud-based VPN solution for remote workforce connectivity
- A SIEM tool that correlates security events across network segments
Correct answer: A dynamic, identity-centric access control model that hides infrastructure from unauthorized users
A Software-Defined Perimeter creates a dynamic perimeter based on user identity and device posture, making infrastructure invisible to unauthorized users until after authentication and authorization succeed.
Question 6: What is a primary challenge when adopting Zero Trust Architecture in legacy enterprise environments?
- Zero Trust requires replacing all existing network hardware immediately
- Legacy systems often lack the APIs and identity integration needed for continuous verification (Correct answer)
- Zero Trust is incompatible with cloud-based identity providers
- Zero Trust mandates the elimination of all existing firewall rules
Correct answer: Legacy systems often lack the APIs and identity integration needed for continuous verification
Legacy systems frequently lack modern APIs, identity federation capabilities, or logging functionality needed to support the continuous verification and policy enforcement that Zero Trust requires.
Question 7: Which of the following is a key component of the Zero Trust 'Five Pillars' model developed by the U.S. Department of Defense (DoD)?
- Perimeter Security, Encryption, Logging, Patching, and Backup
- Identity, Devices, Networks, Applications & Workloads, and Data (Correct answer)
- Firewall, IDS, VPN, SIEM, and Endpoint Protection
- Authentication, Authorization, Accounting, Auditing, and Availability
Correct answer: Identity, Devices, Networks, Applications & Workloads, and Data
The DoD Zero Trust Reference Architecture identifies five pillars: Identity, Devices, Networks, Applications & Workloads, and Data, each requiring continuous verification and least-privilege enforcement.
ACL Zero Trust Architecture & Microsegmentation 2
What is the function of a Policy Decision Point (PDP) in Zero Trust Architecture?