5 Zero Trust Security Free Online FlashCards

What is the core idea of zero trust?

Zero trust removes implicit trust based on a user’s or device’s location, network connection, or ownership, and protects individual resources.

Is zero trust a product or an architectural approach?

Zero trust is an architectural approach, not a single product.

What three ideas summarize zero trust?

Verify explicitly, grant least privilege, and assume a resource or network may be compromised.

What context can inform a zero-trust access decision?

It considers identity, device condition, the resource, and circumstances such as time, location, connection, and observed behavior.

What does continuous verification mean?

It means access can be reassessed during a session as evidence or risk changes; it does not necessarily require repeated password entry.

What does least privilege require?

Grant only the access needed, and only for as long as it is needed.

What roles do the policy engine, administrator, and enforcement point perform?

The policy engine evaluates evidence and decides whether to allow access; the policy administrator carries out that decision; the policy enforcement point controls the connection to the resource.

How do authentication and authorization differ?

Authentication establishes who or what is making a request; authorization determines what it may do.

How does microsegmentation differ from traditional segmentation?

Segmentation divides systems and traffic into smaller, controlled zones; microsegmentation applies finer-grained rules between workloads, applications, or services.

How can segmentation limit the impact of a compromise?

It limits unnecessary connections, so a compromised system has fewer automatically reachable resources and less opportunity for lateral movement.

What does an identity-aware access proxy or ZTNA provide?

An identity-aware access proxy routes a user to an authorized application after evaluating identity and, when available, device and request context, rather than granting broad internal-network access.

How do device posture checks support zero trust?

They report whether a device meets security requirements, allowing access policy to respond to its current status.