Zero trust network architecture in Computer Networks - Step-by-Step Execution

Concept Flow - Zero trust network architecture

User or Device Requests Access

↓

Verify Identity and Device Health

↓

Check Access Policies

↓

Grant Least Privilege Access

↓

Monitor and Log Activity

↓

Re-evaluate Continuously

↓

Access Ends

This flow shows how zero trust verifies every access request by checking identity, device health, and policies before granting limited access, then continuously monitors activity.

Execution Sample

Computer Networks

User requests access
Verify user identity
Check device security
Apply access policy
Grant limited access
Monitor session continuously

This sequence shows the step-by-step process of how zero trust handles an access request.

Analysis Table

Step	Action	Check/Decision	Result/Output
1	User requests access	N/A	Access request received
2	Verify user identity	Is user authenticated?	Yes - proceed; No - deny access
3	Check device security	Is device compliant?	Yes - proceed; No - deny or limit access
4	Apply access policy	What permissions are allowed?	Grant least privilege access
5	Monitor session continuously	Is any suspicious activity detected?	If yes, revoke or limit access; else continue
6	Re-evaluate access	Is session still valid?	If no, end access; else continue monitoring

💡 Access ends when user logs out or session is revoked due to policy or suspicious activity

State Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	Final
User Identity	Unknown	Verified	Verified	Verified	Verified	Verified
Device Status	Unknown	Unknown	Compliant	Compliant	Compliant	Compliant
Access Level	None	None	None	Least Privilege	Least Privilege	Least Privilege
Session State	Inactive	Inactive	Inactive	Active	Active	Ended or Active

Key Insights - 3 Insights

Why does zero trust verify identity every time instead of trusting once?

Because zero trust assumes no user or device is inherently trusted, it verifies identity at each access attempt to prevent unauthorized access, as shown in steps 2 and 6 of the execution_table.

What does 'least privilege access' mean in zero trust?

It means granting only the minimum access rights needed for the task, reducing risk if credentials are compromised, as seen in step 4 where access policy limits permissions.

Why is continuous monitoring important in zero trust?

Because threats can arise anytime during a session, continuous monitoring (step 5) helps detect suspicious activity and revoke access promptly to protect resources.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result after verifying user identity at step 2?

A Access request denied

B Yes - proceed; No - deny access

C Device compliance checked

D Session ended

💡 Hint

Check the 'Result/Output' column for step 2 in the execution_table

At which step does zero trust apply the principle of least privilege?

A Step 4 - Apply access policy

B Step 3 - Check device security

C Step 5 - Monitor session

D Step 6 - Re-evaluate access

💡 Hint

Look for where access permissions are granted in the execution_table

If the device is not compliant at step 3, what happens according to the execution_table?

A Access is granted fully

B User identity is re-verified

C Access is denied or limited

D Session monitoring starts

💡 Hint

Check the 'Check/Decision' and 'Result/Output' columns for step 3

Concept Snapshot

Zero trust network architecture means never trusting any user or device by default.
Every access request is verified for identity and device health.
Access is granted with least privilege needed.
Continuous monitoring detects threats during sessions.
Access is re-evaluated and revoked if suspicious activity occurs.

Full Transcript

Zero trust network architecture is a security approach where no user or device is trusted by default. Every access request goes through verification steps: first, the user's identity is checked to confirm they are who they say they are. Then, the device's security status is checked to ensure it meets compliance rules. Based on these checks, access policies are applied to grant only the minimum permissions needed, called least privilege. During the session, continuous monitoring watches for any suspicious activity. If any threat is detected or the session becomes invalid, access is revoked immediately. This approach helps protect resources by assuming breach and verifying every action.

Practice

1. What is the main principle of Zero Trust Network Architecture?

easy

A. Never trust, always verify every access request

B. Trust all devices inside the network by default

C. Allow unrestricted access to internal resources

D. Use a single password for all users

Solution

1. Step 1: Understand the core idea of Zero Trust

   Zero Trust means no implicit trust is given to any user or device, even inside the network.

2. Step 2: Identify the correct principle

   The principle is to verify every access request before allowing it.

3. Final Answer:

   Never trust, always verify every access request -> Option A

4. Quick Check:

   Zero Trust = Verify every request [OK]

Hint: Remember: Zero Trust means always verify, never trust [OK]

Common Mistakes:

• Assuming internal devices are trusted by default
• Thinking Zero Trust allows open access inside network
• Confusing Zero Trust with simple password policies

2. Which of the following is a correct feature of Zero Trust Network Architecture?

easy

A. Allow all devices to communicate freely once inside the network

B. Trust users based on their IP address alone

C. Use micro-segmentation to limit access to resources

D. Disable multi-factor authentication for ease of access

Solution

1. Step 1: Review Zero Trust features

   Zero Trust uses micro-segmentation to divide the network and limit access to only necessary parts.

2. Step 2: Identify the correct feature

   Micro-segmentation restricts lateral movement and improves security.

3. Final Answer:

   Use micro-segmentation to limit access to resources -> Option C

4. Quick Check:

   Micro-segmentation = Limited access [OK]

Hint: Micro-segmentation limits access inside network [OK]

Common Mistakes:

• Believing all devices are trusted inside network
• Ignoring multi-factor authentication importance
• Trusting users based only on IP addresses

3. Consider this scenario: A user tries to access a sensitive file in a Zero Trust network. The system checks the user's identity, device health, and location before granting access. What is the likely outcome if the device is found to be unpatched and vulnerable?

medium

A. Access is logged but allowed without restrictions

B. Access is granted because the user identity is verified

C. Access is granted but with limited permissions

D. Access is denied due to device health not meeting policy

Solution

1. Step 1: Understand Zero Trust access checks

   Zero Trust verifies multiple factors including device health before access is allowed.

2. Step 2: Apply policy to unpatched device

   An unpatched, vulnerable device fails health checks, so access is denied.

3. Final Answer:

   Access is denied due to device health not meeting policy -> Option D

4. Quick Check:

   Unhealthy device = Access denied [OK]

Hint: Unhealthy devices fail checks, access denied [OK]

Common Mistakes:

• Assuming identity verification alone grants access
• Thinking partial access is allowed despite vulnerabilities
• Ignoring device health in access decisions

4. A network administrator implements Zero Trust but notices users can access resources without verification. What is the most likely error in the setup?

medium

A. All devices are placed in a single trusted zone

B. Micro-segmentation is not properly configured

C. Multi-factor authentication is not enforced

D. User identities are verified but device health is ignored

Solution

1. Step 1: Analyze the symptom

   Users access resources without verification, meaning trust boundaries are missing.

2. Step 2: Identify configuration mistake

   Placing all devices in one trusted zone removes segmentation and verification.

3. Final Answer:

   All devices are placed in a single trusted zone -> Option A

4. Quick Check:

   Single trusted zone = No verification [OK]

Hint: No segmentation means no verification [OK]

Common Mistakes:

• Assuming MFA alone fixes all access issues
• Ignoring network segmentation importance
• Believing device health checks fix trust zone errors

5. A company wants to apply Zero Trust principles to secure remote work. Which combination of actions best supports this goal?

hard

A. Use VPN for all access, trust devices inside VPN, no further checks

B. Implement continuous user verification, device health checks, and micro-segmentation

C. Allow access based on user role only, ignore device security

D. Rely on firewall rules to block external threats, no internal controls

Solution

1. Step 1: Identify key Zero Trust actions for remote work

   Zero Trust requires continuous verification of user identity, device health, and limiting access via segmentation.

2. Step 2: Evaluate options for best fit

   Implement continuous user verification, device health checks, and micro-segmentation includes continuous verification, device checks, and micro-segmentation, covering core Zero Trust needs.

3. Final Answer:

   Implement continuous user verification, device health checks, and micro-segmentation -> Option B

4. Quick Check:

   Continuous checks + segmentation = Zero Trust [OK]

Hint: Combine verification, device checks, and segmentation [OK]

Common Mistakes:

• Trusting devices just because they use VPN
• Ignoring device security in access decisions
• Relying only on perimeter firewalls