An architect needs to deploy a new payroll application on a cloud host. End users' access to the application will be based on the end users' role. In…

The design described implements two fundamental elements of a Zero Trust architecture. First, basing user access on their role is a direct application of the principle of least privilege. This ensures that users are granted only the minimum level of access required to perform their specific job functions, reducing the potential attack surface. Second, deploying the application host on a dedicated and highly restrictive /30 subnet is a form of microsegmentation. This practice isolates the critical payroll application into its own secure network zone, allowing for granular control of traffic to and from the host and preventing unauthorized lateral movement.

B. Device trust: The scenario does not mention any mechanism for assessing the security posture or health of the end-user devices before granting access.

D. CASB: A Cloud Access Security Broker (CASB) is a security policy enforcement point, which is not described in the deployment plan.

E. WAF: A Web Application Firewall (WAF) protects against application-layer attacks, but the scenario does not mention its implementation.

F. MFA: Multi-Factor Authentication (MFA) is an authentication control, whereas the scenario only describes the authorization model (role-based access).

1. National Institute of Standards and Technology. (2020). NIST Special Publication 800-207: Zero Trust Architecture.

For Least Privilege: Section 2.1

Tenet 4 states

"Access to resources is determined by dynamic policy... This is a principle of least privilege and the most granular

reasonable level of access needed to complete the task." The use of roles is a common method to enforce this.

For Microsegmentation: Section 3.1.3

"Micro-Segmentation

" defines the concept as creating "small

secure zones in data centers and cloud deployments to isolate workloads from one another and secure them individually." Placing a host in a /30 subnet is a direct implementation of this.

2. Gilman

D. W.

& Rafferty

G. F. (2021). A zero trust architecture model for the enterprise. Johns Hopkins APL Technical Digest

35(4)

10-23.

This publication identifies the "principle of least privilege" as a foundational concept of Zero Trust (p. 12

Section: Foundational Concepts). It also describes microsegmentation as a key enabler that "protects the enterprise from lateral movement by segmenting the network into small zones" (p. 15

Section: Network Requirements).