Effective CISSP Questions

You are evaluating solutions that can mitigate the threat of lateral movement. Which of the following least aligns with the principles of Zero Trust? (Wentz QOTD)
A. Place critical servers in the DMZ for isolation
B. Implement EAP-TLS for mutual authentication
C. Enforce 802.1X for network access control
D. Enable mirroring ports on switch hubs for sniffing

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

My suggested answer is A. Place critical servers in the DMZ for isolation.

Castle and Moat
Castle and Moat

No inherent trust in physical network locations or perimeter is the very first concept of Zero Trust. Traditionally, people thought hosts located in LAN are safer than those in DMZ, and those in DMZ is safer than those exposed to public networks. This is the traditional perspective of security that relies on physical network locations or perimeter, also known as the castle and moat model.

Zero Trust doesn’t rely on physical network isolation but the software-defined or virtual perimeter surrounding the data of interest.

Zero Trust

Zero Trust is a Cybersecurity Paradigm for a Fine-grained, Dynamic, and Data-centric Access Control that supports visibility.

  • Fine-grained authorization based on attribute or risk can be supported by standards such as XACML.
  • Dynamic access control means access control rules can be added or removed dynamically. For example, a firewall defaults to one and only one policy that denies all traffic; dynamic rules can be added through techniques such as port knocking.
  • Data-centric or resource-centric means not to rely on the physical network perimeter but the software-defined or virtual perimeter that protects data or resources.
  • Visibility refers not only to recording logs but also contents, e.g., network traffic.
  • Access control is mediating the usage of resources by authentication, authorization, and accounting based on the principles of need-to-know and least privileges.
  • I treat Zero Trust as Access Control 2.0.

Evolvement of Zero Trust Concepts

Evolvement of Zero Trust Concepts
Evolvement of Zero Trust Concepts

Zero Trust Cybersecurity Paradigm based on NIST SP 800-27

Zero Trust Cybersecurity Paradigm
Zero Trust Cybersecurity Paradigm



My new book, The Effective CISSP: Security and Risk Management, helps CISSP aspirants build a solid conceptual security model. It is not only a tutorial for information security but also a study guide for the CISSP exam and an informative reference for security professionals.

您正在評估可以減輕橫向移動(lateral movement)威脅的解決方案。 以下哪一項最不符合零信任(Zero Trust)原則?(Wentz QOTD)
A. 將關鍵服務器放置在DMZ中以進行隔離
B. 實施EAP-TLS進行相互認證(mutual authentication)
C. 強制執行802.1X以進行網絡訪問控制
D. 在交換集線器上啟用鏡像端口以進行嗅探(sniffing)

Leave a Reply