Practise vocabulary for zero trust design: never-trust-always-verify, identity-aware proxies, microsegmentation, and continuous verification.
0 / 15 completed
1 / 15
The core principle of Zero Trust architecture is ___.
Zero Trust's core principle is 'never trust, always verify' — no user, device, or service is trusted by default, even inside the corporate network. Every access request must be verified.
2 / 15
In zero trust, a ___ sits in front of applications and enforces access policies based on user identity, device posture, and context.
An Identity-Aware Proxy (IAP) enforces zero-trust access control at the application layer — it verifies identity and device context before allowing access, replacing the need for a VPN.
3 / 15
___ divides a network into small zones so that even if one zone is compromised, lateral movement to other zones is blocked.
Microsegmentation creates fine-grained network segments around individual workloads. Even if an attacker compromises one workload, they cannot move laterally to other segments without re-authentication.
4 / 15
The BeyondCorp model, developed by Google, moved security from the ___ to the individual user and device.
BeyondCorp shifted the security focus from the network perimeter (VPN-based) to verifying individual user identity and device posture for every request, regardless of network location.
5 / 15
In zero trust, ___ access continuously re-evaluates trust based on changing context such as user location, device health, and behaviour.
Context-aware access (also called adaptive access) continuously evaluates risk signals — if a user's device becomes unhealthy or behaviour changes, access can be revoked mid-session without requiring re-login.
6 / 15
Review Comment: 'I'm not sure I fully understand the justification for restricting access to the database server via VPN only. It seems overly complex for a simple read operation. Shouldn't we be leveraging our existing MFA and device trust policies?' Which of the following best represents the reasoning behind this Zero Trust approach?
This question tests understanding of the core principle beyond simply stating 'security'. The correct answer reflects the fundamental Zero Trust belief that no user or device should be implicitly trusted. The other options represent common misconceptions – VPNs aren't *for* simplicity, and heightened protection isn't automatically required; it's based on risk assessment and continuous verification.
7 / 15
Slack Message from Alex (Security Engineer): 'Just deployed a new policy enforcing context-aware access for the internal API. Now, any user accessing it from outside the corporate network needs to prove they're on a managed device AND have a valid VPN connection. It's a big shift!' What does 'context-aware access' primarily refer to in this scenario?
This assesses understanding of a key ZTA component. 'Context-aware' moves beyond simple authentication. The correct answer highlights that trust is continuously reassessed based on *multiple* variables – location being critical in this case - which aligns with Zero Trust's principle of least privilege. Misconceptions include assuming it's just username/password, or a blanket denial.
8 / 15
PR Description for a New Service Account: 'We've created a new service account named service-analytics-prod with limited permissions to access the data warehouse. This account utilizes ___ to continuously verify its identity and authorization before granting access, mitigating potential security risks.'
This tests the ability to articulate a technical implementation. The correct answer – dynamic authentication – directly reflects Zero Trust's core concept of continuous verification. RBAC is a common component *within* a ZTA framework but isn't the overarching principle itself. Static credentials are antithetical to ZTA and SSO doesn't inherently provide that continuous validation.
9 / 15
Standup Update from Sarah (Dev Lead): 'We're implementing a microsegmentation strategy to isolate our development and staging environments. This means no direct network traffic is allowed between them; all communication must go through a secure proxy.' What security benefit does this primarily address within the context of Zero Trust?
This question focuses on a practical ZTA implementation. The correct answer – preventing lateral movement – is the core benefit of microsegmentation within a Zero Trust architecture. While performance *could* be a side effect, it's not the primary goal. The other options represent secondary or unrelated benefits.
10 / 15
API Response (Partial): `{'user': {'identity': 'john.doe', 'device_trust_score': 95, 'location': 'New York'}, 'access_granted': true}` What does the 'device_trust_score' field in this response indicate within a Zero Trust system?
This scenario tests understanding of dynamic trust. The 'device_trust_score' represents the ongoing assessment of a device's security posture – a critical element of Zero Trust. It demonstrates that trust isn't static and is continuously recalculated based on various factors. The other options misinterpret the function of this data point.
11 / 15
Review Comment: 'I'm not sure I fully understand the justification for restricting access to the database server via VPN only. It seems overly complex for a simple read operation. Shouldn't we be leveraging our existing MFA and device trust policies?' Which of the following best represents the reasoning behind this Zero Trust approach?
This question tests understanding of the core principle beyond simply stating 'security'. The correct answer reflects the fundamental Zero Trust belief that no user or device should be implicitly trusted. The other options represent common misconceptions – VPNs aren't *for* simplicity, and heightened protection isn't automatically required; it's based on risk assessment and continuous verification.
12 / 15
Slack Message from Alex (Security Engineer): 'Just deployed a new policy enforcing context-aware access for the internal API. Now, any user accessing it from outside the corporate network needs to prove they're on a managed device AND have a valid VPN connection. It's a big shift!' What does 'context-aware access' primarily refer to in this scenario?
This assesses understanding of a key ZTA component. 'Context-aware' moves beyond simple authentication. The correct answer highlights that trust is continuously reassessed based on *multiple* variables – location being critical in this case - which aligns with Zero Trust's principle of least privilege. Misconceptions include assuming it's just username/password, or a blanket denial.
13 / 15
PR Description for a New Service Account: 'We've created a new service account named service-analytics-prod with limited permissions to access the data warehouse. This account utilizes ___ to continuously verify its identity and authorization before granting access, mitigating potential security risks.'
This tests the ability to articulate a technical implementation. The correct answer – dynamic authentication – directly reflects Zero Trust's core concept of continuous verification. RBAC is a common component *within* a ZTA framework but isn't the overarching principle itself. Static credentials are antithetical to ZTA and SSO doesn't inherently provide that continuous validation.
14 / 15
Standup Update from Sarah (Dev Lead): 'We're implementing a microsegmentation strategy to isolate our development and staging environments. This means no direct network traffic is allowed between them; all communication must go through a secure proxy.' What security benefit does this primarily address within the context of Zero Trust?
This question focuses on a practical ZTA implementation. The correct answer – preventing lateral movement – is the core benefit of microsegmentation within a Zero Trust architecture. While performance *could* be a side effect, it's not the primary goal. The other options represent secondary or unrelated benefits.
15 / 15
API Response (Partial): `{'user': {'identity': 'john.doe', 'device_trust_score': 95, 'location': 'New York'}, 'access_granted': true}` What does the 'device_trust_score' field in this response indicate within a Zero Trust system?
This scenario tests understanding of dynamic trust. The 'device_trust_score' represents the ongoing assessment of a device's security posture – a critical element of Zero Trust. It demonstrates that trust isn't static and is continuously recalculated based on various factors. The other options misinterpret the function of this data point.
What will I practise in "Zero Trust Architecture Language"?
Practise vocabulary for zero trust design: never-trust-always-verify, identity-aware proxies, microsegmentation, and continuous verification.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Identity & Access Management exercises?
Browse the full Identity & Access Management hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.