Zero Trust — Quiz

📋 Instructions: Answer all questions, then click Grade Quiz to see your results.

1. What is the core principle of the Zero Trust security model?

Trust all internal network traffic by default Apply verification only to external users and devices Never trust, always verify — every access request requires authentication and authorization regardless of location Trust users after they pass initial perimeter authentication

✅ C — Zero Trust's core principle is "never trust, always verify." No user or device is trusted by default, whether inside or outside the network perimeter. Every access request requires authentication, authorization, and continuous validation.

2. Which network plane is responsible for processing and forwarding actual data traffic — frames, packets, NAT, and encryption — in real time?

Control Plane Management Plane Policy Plane Data Plane

✅ D — The Data Plane handles the actual movement of network traffic: frames, packets, NAT translation, trunking, and encryption. The Control Plane manages how the Data Plane behaves (routing tables, firewall rules, session policies).

3. A user attempts to access a protected resource. Which Zero Trust component evaluates the request against policies and makes the grant, deny, or revoke decision?

Policy Enforcement Point (PEP) Policy Administrator Policy Engine Security Zone Controller

✅ C — The Policy Engine (part of the PDP) evaluates access requests against policies and contextual information. It acts as the "judge" — making grant/deny/revoke decisions. The Policy Administrator then communicates those decisions to the PEP. The PEP enforces them.

4. Adaptive Identity differs from standard Multi-Factor Authentication (MFA) in that it:

Requires three or more factors for all logins Only applies to privileged administrator accounts Uses biometrics instead of passwords as the primary factor Evaluates risk context and dynamically adjusts verification requirements — MFA may only trigger when risk is elevated

✅ D — Adaptive Identity evaluates multiple risk indicators (location, device health, IP reputation, time of day, relationship to org) and dynamically adjusts requirements. A low-risk login may only need a password; a high-risk login triggers MFA automatically. Standard MFA always requires 2+ factors regardless of context.

5. How does Zero Trust architecture prevent lateral movement after an attacker gains initial access to a network?

By encrypting all data at rest so the attacker cannot read files By requiring re-verification for every access to every resource, so each hop between systems requires new authentication and authorization By blocking all traffic between internal network segments permanently By using a single firewall at the perimeter to detect unusual movement

✅ B — Zero Trust prevents lateral movement by requiring re-verification for every resource access, not just at the perimeter. An attacker who compromises one system cannot automatically move to others — every lateral hop requires new authentication and authorization, limiting breach impact.

6. Matching: Match each Zero Trust component to its correct role.

COMPONENT

Policy Enforcement Point (PEP)

Policy Decision Point (PDP)

Policy Administrator

Adaptive Identity

ROLE

The GATEKEEPER — all traffic passes through it; allows, monitors, and terminates connections

The JUDGE — evaluates policies and context to make access decisions (contains Policy Engine + Policy Admin)

The MESSENGER — generates access tokens and communicates decisions to the PEP

Context-aware auth that evaluates risk indicators and dynamically adjusts verification requirements

7. Analysis: A company implements Zero Trust only at the network perimeter — external users are verified, but once inside, all internal traffic is trusted automatically. What critical Zero Trust requirement is missing, and what attack does this leave the organization vulnerable to?

Missing Requirement: Continuous, granular verification of all internal traffic. Zero Trust requires that EVERY access request — including lateral movement between internal systems — be authenticated and authorized, not just perimeter entry.

Resulting Vulnerability: Lateral Movement. If an attacker compromises one internal system (e.g., via phishing or a supply chain attack), they can freely move between internal systems, escalate privileges, and reach high-value assets. This is exactly the perimeter security model that Zero Trust was designed to replace. The missing control is per-resource PEP enforcement and per-request Policy Engine evaluation for all internal access, not just external.

8. Evaluation: A CISO argues: "Zero Trust is all-or-nothing — unless you implement it perfectly across every system simultaneously, it provides no security benefit." Evaluate this claim. Is Zero Trust an all-or-nothing proposition? Support your answer with reasoning about implementation approaches.

Disagree — Zero Trust is NOT all-or-nothing.

Zero Trust is a framework and philosophy that can be implemented incrementally. Each phase of implementation provides measurable security improvement:

• Phase 1: Implement strong identity verification (MFA, adaptive identity) — immediately reduces credential-based attacks
• Phase 2: Add device health validation — reduces risk from unmanaged endpoints
• Phase 3: Apply micro-segmentation to the most critical assets first — limits lateral movement in the highest-risk areas
• Phase 4: Extend PEP/PDP coverage incrementally across remaining resources

The security improvement at each phase is real and valuable, even without complete implementation. The CISO's "all-or-nothing" claim reflects a common misconception. In practice, Google's BeyondCorp and NIST SP 800-207 both describe phased Zero Trust adoption as the standard approach.

Zero Trust Quiz