CompTIA SecurityX (CAS-005)Security ArchitectureEasy
A security architect is designing a system for a highly distributed global manufacturing company that has numerous remote sites, mobile users, and a mix of on-premises and cloud applications. The company wants to shift from a perimeter-based security model to one that assumes no implicit trust, regardless of location. Which security architecture best fits this description?
- AVirtual Private Network (VPN)
- BTraditional Firewall-centric Architecture
- CZero Trust Architecture (ZTA)
- DDemilitarized Zone (DMZ)
Show answer & explanationAnswer & explanation
Correct answer: C. Zero Trust Architecture (ZTA)
Zero Trust Architecture (ZTA) is explicitly designed to assume no implicit trust, requiring continuous verification for every user and device attempting to access resources, regardless of their location or network segment. This aligns perfectly with a highly distributed global company with diverse access points.
Why the other options are wrong
- A. A VPN provides secure access to a private network over a public one, but once connected, it often grants broad access based on a perimeter model, rather than continuous verification for every resource.
- B. A traditional firewall-centric architecture is inherently perimeter-based, granting trust to anything inside the firewall, which contradicts the 'no implicit trust' requirement.
- D. A DMZ is a network segment that exposes external-facing services to an untrusted network, still relying on network segmentation and implicit trust within the internal network.
Zero Trust Architecture (ZTA)
Zero Trust Architecture (ZTA) is a security model based on the principle of 'never trust, always verify.' It requires strict identity verification for every user and device attempting to access resources, regardless of whether they are inside or outside the network perimeter.
- Assumes no implicit trust for any user, device, or network segment.
- Requires continuous verification of identity and device posture.
- Enforces least privilege access.
- Micro-segmentation is a key component.
Memory trick: Zero Trust: Never Trust, Always Verify for Every Virtual Thing.