N10-009 Question 128
Single answerZero trust architecture (ZTA): Policy-based authentication, Authorization, Least privilege accessA company is replacing its traditional VPN with a zero trust architecture (ZTA) solution for internal web applications. Employees currently authenticate once to the VPN and then have broad access to multiple internal systems, even if their jobs require only one application. The security team wants access decisions to be based on user identity, device compliance status, and the specific application being requested. They also want to reduce the impact of compromised credentials by ensuring users receive only the minimum access required for their roles. Which solution best meets these requirements?
- A
Deploy an application-aware access proxy that evaluates identity, device posture, and role-based policy before allowing access to each application
- B
Keep the VPN and place all internal applications on the same subnet so authenticated users can reach resources more efficiently
- C
Implement a network ACL that permits employee IP ranges to access all internal application servers after initial login
- D
Use a shared administrator account for each department so access can be centrally managed and audited more easily
Show answer and explanation
Correct answer: A
Explanation
The best answer is the application-aware access proxy that enforces policy-based authentication and authorization for each application request. In zero trust architecture, access should be explicitly verified based on multiple signals such as user identity, device compliance or posture, and context. Access should also be limited to the specific resource required, which is a core least privilege principle. This differs from legacy VPN models that often grant broad network access after a single authentication event. Guidance from NIST SP 800-207 on Zero Trust Architecture emphasizes continuous evaluation, policy decision points, and resource-specific access rather than implicit trust based on network location. Least privilege and per-session or per-request authorization are key best practices for reducing lateral movement and minimizing the impact of compromised credentials.
- A. Correct.
Correct. This approach aligns with zero trust principles by making policy-based authentication and authorization decisions for each application request rather than granting broad network access after a single login. Evaluating identity, device posture, and role supports contextual access control, and limiting access per application enforces least privilege. This is consistent with ZTNA-style designs that provide application-level access instead of full network-level connectivity.
- B. Incorrect.
Incorrect. Traditional VPN access commonly creates excessive trust once the user is connected, which is the problem described in the scenario. Placing applications on the same subnet does not improve authorization controls and can increase the attack surface by making lateral movement easier after authentication.
- C. Incorrect.
Incorrect. A network ACL based on employee IP ranges is not sufficient for zero trust because it primarily relies on network location rather than continuous, policy-driven evaluation of user identity, device health, and requested resource. It also tends to authorize broad access at the network layer instead of limiting access to only the specific application needed.
- D. Incorrect.
Incorrect. Shared administrator accounts violate least privilege and undermine accountability because actions cannot be reliably tied to an individual user. Zero trust architectures depend on strong identity-based controls, unique accounts, and granular authorization decisions rather than broad shared privileged access.