What is the core principle of Zero Trust Architecture (ZTA)?
Zero Trust abandons the old "castle-and-moat" model where anything inside the perimeter is trusted. NIST SP 800-207 defines the principle: "never trust, always verify." Every access request — even from inside the corporate network — must be authenticated (who are you?), authorized (are you allowed?), and continuously validated. Trust is never granted implicitly based on network location. Each resource access is evaluated against identity, device posture, and context. Google's BeyondCorp was the pioneering large-scale implementation, removing the privileged corporate VPN entirely.
2 / 5
What does microsegmentation achieve in a Zero Trust network?
Microsegmentation creates fine-grained security zones around individual workloads or applications, each with its own policy. The goal is to stop lateral movement — the technique attackers use to pivot from an initially compromised host to higher-value targets. In a flat network, one breached machine can reach everything; with microsegmentation, an attacker who compromises the web tier still cannot reach the database tier without passing additional policy checks. It is typically enforced by software-defined networking, host firewalls, or a service mesh applying mTLS and authorization policies between every service pair.
3 / 5
In Zero Trust, what is the policy decision point (PDP) vs the policy enforcement point (PEP)?
NIST's ZTA model splits the control logic. The Policy Decision Point (the "brain") takes signals — identity, device health, location, time, risk score — and computes whether to grant access. The Policy Enforcement Point (the "gate") is positioned in the traffic path and executes the verdict: it establishes or terminates the session. This separation lets you centralize policy logic while distributing enforcement close to each resource. An access proxy is a common PEP; the identity provider plus policy engine form the PDP.
4 / 5
What is the role of device posture assessment in Zero Trust?
Device posture (or device trust) means access decisions consider the health of the requesting device, not just the user's identity. Even a correctly authenticated user on a compromised, unpatched, or unmanaged laptop may be denied access to sensitive resources. Signals include: is disk encryption on? Is the OS up to date? Is endpoint detection and response (EDR) running? Is the device enrolled in MDM? This is why Zero Trust is described as identity-centric AND device-aware — and why posture is re-evaluated continuously, not just at login.
5 / 5
What problem with traditional VPNs does Zero Trust Network Access (ZTNA) solve?
ZTNA replaces the VPN's all-or-nothing model. A traditional VPN places the connected device onto the internal network — once you are "in," you can often reach far more than you need, and the network implicitly trusts you. If your laptop is compromised, the attacker inherits that broad reach. ZTNA instead brokers access to specific applications through an identity-aware proxy, never exposing the underlying network. Access is least-privilege by default and continuously re-evaluated. Applications are effectively invisible (dark) to anyone not explicitly authorized.
What does the "Zero Trust Architecture" vocabulary exercise cover?
This exercise tests real IT vocabulary related to zero trust architecture through 5 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 5 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 1 other vocabulary module. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.