Zero Trust Architecture Vocabulary
Master zero trust security vocabulary: never trust always verify, micro-segmentation, identity-centric security, and least privilege.
0 / 22 completed
1 / 22
Zero trust architecture is based on the principle:
Zero trust eliminates the concept of a trusted internal network — every access request is validated against identity, device health, and policy, even for internal users.
2 / 22
Micro-segmentation in zero trust means:
Micro-segmentation enforces granular access between workloads — even inside the data centre. An attacker who compromises one segment cannot move freely to others.
3 / 22
The principle of 'least privilege' in zero trust requires:
Least privilege limits the blast radius of a breach — a compromised account with minimal permissions can do minimal damage compared to one with broad access.
4 / 22
In zero trust, 'continuous verification' means:
Continuous verification goes beyond session-token authentication — it evaluates risk signals throughout the session and can revoke access if behaviour becomes anomalous.
5 / 22
A Software-Defined Perimeter (SDP) in zero trust provides:
SDP makes infrastructure invisible to unauthorised users — resources are only reachable after authentication, effectively hiding them from network scanning and unauthenticated access.
6 / 22
PR Description
Subject: Security Audit - API Gateway Access Review
Hi Team,
During our recent security audit, we've identified potential vulnerabilities related to unrestricted access to the internal API gateway. To mitigate this, I'm requesting that all developers utilizing the API gateway temporarily restrict their access to only the specific endpoints required for their tasks. We'll be implementing granular role-based access control (RBAC) soon.
Thanks,
MarkThis question tests understanding of applying 'least privilege' in a practical scenario. The PR description directly asks for restricted access based on task requirements, mirroring the core concept of limiting user access to only what's necessary. Options A and B are completely contrary to Zero Trust principles, while option D represents a reactive (rather than proactive) approach to security – the key is minimizing the attack surface by reducing the potential impact of compromised credentials.
7 / 22
Mark in the PR description states, "I'm requesting that all developers utilizing the API gateway temporarily restrict their access to only the specific endpoints required for their tasks. We'll be implementing granular role-based access control (RBAC) soon.". Which of the following best describes Mark's intent regarding 'least privilege' within this context? A. He is instructing developers to bypass existing authentication protocols for faster development cycles.
B. He is advocating for a temporary, broad restriction on API access, intending to later refine permissions through RBAC and enforce the principle of least privilege by limiting individual developer scope.
C. He's proposing that all developers should be granted full administrative privileges to the API gateway to facilitate rapid troubleshooting.
D. He is suggesting a complete overhaul of the API gateway's design, eliminating any reliance on existing access controls.
Mark's statement directly relates to the concept of 'least privilege'. The correct answer recognizes that he's initially implementing a temporary restriction – a pragmatic approach – before establishing more precise RBAC. This aligns with the core tenet: users should only have access to the resources absolutely necessary for their job function, minimizing potential damage if an account is compromised. Options A and C misinterpret his intent by suggesting bypassing security measures or granting excessive permissions respectively; option D is completely unrelated.
8 / 22
Mark's request for developers to temporarily restrict access to the API gateway endpoints aligns with the zero trust principle of 'least privilege'. Considering this, which statement best reflects Mark's underlying strategy regarding developer permissions and ongoing security posture?
Mark is employing a phased approach – temporarily restricting access and then implementing RBAC. This directly embodies the 'least privilege' principle by limiting developer scope to only what's necessary during the immediate mitigation phase. The incorrect options either suggest over-reliance on broad permissions or a less proactive security stance, failing to address the core concern of minimizing potential impact in case of compromise.
9 / 22
PR Description
Subject: Security Audit - API Gateway Access Review
Hi Team,
During our recent security audit, we've identified potential vulnerabilities related to unrestricted access to the internal API gateway. To mitigate this, I'm requesting that all developers utilizing the API gateway temporarily restrict their access to only the specific endpoints required for their tasks. We'll be implementing granular role-based access control (RBAC) soon.
Thanks,
MarkThis question tests understanding of applying 'least privilege' in a practical scenario. The PR description directly asks for restricted access based on task requirements, mirroring the core concept of limiting user access to only what's necessary. Options A and B are completely contrary to Zero Trust principles, while option D represents a reactive (rather than proactive) approach to security – the key is minimizing the attack surface by reducing the potential impact of compromised credentials.
10 / 22
Mark in the PR description states, "I'm requesting that all developers utilizing the API gateway temporarily restrict their access to only the specific endpoints required for their tasks. We'll be implementing granular role-based access control (RBAC) soon.". Which of the following best describes Mark's intent regarding 'least privilege' within this context? A. He is instructing developers to bypass existing authentication protocols for faster development cycles.
B. He is advocating for a temporary, broad restriction on API access, intending to later refine permissions through RBAC and enforce the principle of least privilege by limiting individual developer scope.
C. He's proposing that all developers should be granted full administrative privileges to the API gateway to facilitate rapid troubleshooting.
D. He is suggesting a complete overhaul of the API gateway's design, eliminating any reliance on existing access controls.
Mark's statement directly relates to the concept of 'least privilege'. The correct answer recognizes that he's initially implementing a temporary restriction – a pragmatic approach – before establishing more precise RBAC. This aligns with the core tenet: users should only have access to the resources absolutely necessary for their job function, minimizing potential damage if an account is compromised. Options A and C misinterpret his intent by suggesting bypassing security measures or granting excessive permissions respectively; option D is completely unrelated.
11 / 22
Mark's request for developers to temporarily restrict access to the API gateway endpoints aligns with the zero trust principle of 'least privilege'. Considering this, which statement best reflects Mark's underlying strategy regarding developer permissions and ongoing security posture?
Mark is employing a phased approach – temporarily restricting access and then implementing RBAC. This directly embodies the 'least privilege' principle by limiting developer scope to only what's necessary during the immediate mitigation phase. The incorrect options either suggest over-reliance on broad permissions or a less proactive security stance, failing to address the core concern of minimizing potential impact in case of compromise.
12 / 22
PR Description
Subject: Security Audit - API Gateway Access Review
Hi Team,
During our recent security audit, we've identified potential vulnerabilities related to unrestricted access to the internal API gateway. To mitigate this, I'm requesting that all developers utilizing the API gateway temporarily restrict their access to only the specific endpoints required for their tasks. We'll be implementing granular role-based access control (RBAC) soon.
Thanks,
MarkThis question tests understanding of applying 'least privilege' in a practical scenario. The PR description directly asks for restricted access based on task requirements, mirroring the core concept of limiting user access to only what's necessary. Options A and B are completely contrary to Zero Trust principles, while option D represents a reactive (rather than proactive) approach to security – the key is minimizing the attack surface by reducing the potential impact of compromised credentials.
13 / 22
Mark in the PR description states, "I'm requesting that all developers utilizing the API gateway temporarily restrict their access to only the specific endpoints required for their tasks. We'll be implementing granular role-based access control (RBAC) soon.". Which of the following best describes Mark's intent regarding 'least privilege' within this context? A. He is instructing developers to bypass existing authentication protocols for faster development cycles.
B. He is advocating for a temporary, broad restriction on API access, intending to later refine permissions through RBAC and enforce the principle of least privilege by limiting individual developer scope.
C. He's proposing that all developers should be granted full administrative privileges to the API gateway to facilitate rapid troubleshooting.
D. He is suggesting a complete overhaul of the API gateway's design, eliminating any reliance on existing access controls.
Mark's statement directly relates to the concept of 'least privilege'. The correct answer recognizes that he's initially implementing a temporary restriction – a pragmatic approach – before establishing more precise RBAC. This aligns with the core tenet: users should only have access to the resources absolutely necessary for their job function, minimizing potential damage if an account is compromised. Options A and C misinterpret his intent by suggesting bypassing security measures or granting excessive permissions respectively; option D is completely unrelated.
14 / 22
Mark's request for developers to temporarily restrict access to the API gateway endpoints aligns with the zero trust principle of 'least privilege'. Considering this, which statement best reflects Mark's underlying strategy regarding developer permissions and ongoing security posture?
Mark is employing a phased approach – temporarily restricting access and then implementing RBAC. This directly embodies the 'least privilege' principle by limiting developer scope to only what's necessary during the immediate mitigation phase. The incorrect options either suggest over-reliance on broad permissions or a less proactive security stance, failing to address the core concern of minimizing potential impact in case of compromise.
15 / 22
PR Description
Subject: Security Audit - API Gateway Access Review
Hi Team,
During our recent security audit, we've identified potential vulnerabilities related to unrestricted access to the internal API gateway. To mitigate this, I'm requesting that all developers utilizing the API gateway temporarily restrict their access to only the specific endpoints required for their tasks. We'll be implementing granular role-based access control (RBAC) soon.
Thanks,
MarkThis question tests understanding of applying 'least privilege' in a practical scenario. The PR description directly asks for restricted access based on task requirements, mirroring the core concept of limiting user access to only what's necessary. Options A and B are completely contrary to Zero Trust principles, while option D represents a reactive (rather than proactive) approach to security – the key is minimizing the attack surface by reducing the potential impact of compromised credentials.
16 / 22
Mark in the PR description states, "I'm requesting that all developers utilizing the API gateway temporarily restrict their access to only the specific endpoints required for their tasks. We'll be implementing granular role-based access control (RBAC) soon.". Which of the following best describes Mark's intent regarding 'least privilege' within this context? A. He is instructing developers to bypass existing authentication protocols for faster development cycles.
B. He is advocating for a temporary, broad restriction on API access, intending to later refine permissions through RBAC and enforce the principle of least privilege by limiting individual developer scope.
C. He's proposing that all developers should be granted full administrative privileges to the API gateway to facilitate rapid troubleshooting.
D. He is suggesting a complete overhaul of the API gateway's design, eliminating any reliance on existing access controls.
Mark's statement directly relates to the concept of 'least privilege'. The correct answer recognizes that he's initially implementing a temporary restriction – a pragmatic approach – before establishing more precise RBAC. This aligns with the core tenet: users should only have access to the resources absolutely necessary for their job function, minimizing potential damage if an account is compromised. Options A and C misinterpret his intent by suggesting bypassing security measures or granting excessive permissions respectively; option D is completely unrelated.
17 / 22
Mark's request for developers to temporarily restrict access to the API gateway endpoints aligns with the zero trust principle of 'least privilege'. Considering this, which statement best reflects Mark's underlying strategy regarding developer permissions and ongoing security posture?
Mark is employing a phased approach – temporarily restricting access and then implementing RBAC. This directly embodies the 'least privilege' principle by limiting developer scope to only what's necessary during the immediate mitigation phase. The incorrect options either suggest over-reliance on broad permissions or a less proactive security stance, failing to address the core concern of minimizing potential impact in case of compromise.
18 / 22
Sarah, the security engineer, is explaining a new incident response plan to the development team. She says, "We're shifting from assuming trust within our network to verifying every request. Essentially, we don't trust anything until it proves itself." Which zero trust concept does Sarah best represent?
Sarah's statement highlights the core principle of 'continuous verification,' where every access request is scrutinized and validated. This directly opposes the traditional network model of implicit trust. Options A and C refer to specific technologies or concepts, while option B describes a different security measure (IAP) and option D refers to a broader architectural approach.
19 / 22
Reviewer John comments on a pull request with the following text: 'This code accesses the database directly. We should implement stricter access controls and utilize a service mesh to enforce granular authorization policies.' What zero trust principle is John primarily addressing?
John's comment directly relates to the 'least privilege' principle. This means that code should only have access to the specific resources it needs and nothing more. Allowing direct database access violates this core concept. ZTNA is a broader approach encompassing many of these principles, but least privilege is the immediate issue here.
20 / 22
"Hey team, noticed some unusual traffic patterns on the internal API. Let's enforce stricter authentication and authorization rules across all services – basically treat every request as if it's coming from an untrusted source. Anyone trying to access a resource should be prompted for multi-factor authentication."
Based on this Slack message, which zero trust strategy is being prioritized?
The message emphasizes requiring MFA for *every* request, indicating a focus on verifying the identity of the user – a key component of MFA. While network segmentation and behavioral analytics are also part of zero trust, this specific Slack message directly addresses the authentication layer, where verification occurs. Device posture is related to device security, not access control.
21 / 22
During a code review of a new microservice deployment, David writes in the PR description: 'We've implemented a Software Defined Perimeter around this service. This dynamically restricts network access based on user identity and device posture – ensuring only authorized users can reach it.' Which zero trust component is David describing?
David's description accurately identifies a Software Defined Perimeter (SDP) as a key component of zero trust. SDP dynamically controls access based on contextual factors like user identity and device posture, rather than relying on static network boundaries. ZTNA is a broader framework that can *include* an SDP, but this PR focuses specifically on the perimeter aspect.
22 / 22
"Okay team, I'm updating everyone – we're moving to a zero trust model for accessing our development environment. We'll be implementing contextual access controls based on device health and user role, requiring MFA for all new connections. We need to ensure every user is authenticated and authorized before they can access any resources."
Which of the following best summarizes this update's focus within a zero trust architecture?
The update highlights 'contextual access controls based on device health and user role' alongside MFA, directly representing the continuous authentication aspect of zero trust. This means verifying *who* is accessing *what*, at *which time*, under *what conditions*. Centralized logging and identity governance are supporting functions but not the core focus of this specific update.
Frequently Asked Questions
What does the "Zero Trust Architecture Vocabulary" exercise practise?
Master zero trust security vocabulary: never trust always verify, micro-segmentation, identity-centric security, and least privilege.
How many questions are in this exercise?
This exercise has 22 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Cybersecurity category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "Zero Trust Architecture Vocabulary" part of a larger series?
Yes — it's one exercise in the Cybersecurity category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Cybersecurity category page for related exercises, or browse the main Exercises hub for other IT English topics.