CoreQ Academy2.6 Given a scenario, integrate Zero Trust concepts into system architecture design.
Zero Trust removes implicit trust from the network. Every request is authenticated, authorised against context and continuously re-evaluated.
Continuous evaluation
- Continuous authorization
- Access is re-evaluated during the session, not just at login.
- Context-based reauthentication
- Requiring re-authentication when context changes (new location, device risk, sensitive action).
Network architecture
- Segmentation
- Dividing networks into zones.
- Microsegmentation
- Fine-grained policies per workload or application.
- VPN
- Traditional remote access; in Zero Trust often replaced by identity-aware access proxies.
- Always-on VPN
- Device always connects through the VPN so policy and monitoring apply everywhere.
Integration and assets
- API integration and validation
- Every API call authenticated, authorised and validated.
- Asset identification, management, and attestation
- Knowing every device and verifying its health before trusting it.
Security boundaries
- Data perimeters
- Guardrails ensuring only trusted identities access trusted resources from expected networks.
- Secure zone
- Protected enclaves for the most sensitive assets.
- System components
- Each component treated as its own boundary.
Deperimeterization
- Deperimeterization
- Moving away from a single network perimeter to identity- and data-centric controls.
- Secure access service edge (SASE)
- Cloud-delivered combination of networking and security services close to users.
- Software-defined wide area network (SD-WAN)
- Policy-driven WAN connectivity across multiple links.
- Software-defined networking
- Programmable networks enabling dynamic, policy-based segmentation.
Defining subject-object relationships
- Defining subject-object relationships
- Explicitly mapping which subjects (users, services, devices) may access which objects (data, apps) under which conditions.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 2.6 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.