An analysis of the question is provided below.
Evaluation of the Question
The question asks to identify the requirement that is not aligned with a "Zero Trust" approach to access management for third parties. The core principle of Zero Trust is to abandon the idea of a trusted internal network and an untrusted external network. Instead, it mandates that every access request must be strictly verified, regardless of its origin. This involves verifying the user and device, ensuring least-privilege access, and assuming the environment is already compromised. The correct answer will be the option that relies on an implicit trust model, such as trust based on network location.
Correct Answer: A
A. Granting access based on the third party's location within a "trusted" network segment.
Explanation
A Zero Trust architecture is a security model based on the principle of "never trust, always verify." It assumes that no user or device is inherently trustworthy, regardless of its physical or network location. Granting access based on a third party's presence within a so-called "trusted" network segment directly contradicts this core tenet. Zero Trust requires that all access requests be authenticated, authorized, and encrypted before access is granted, and that access is limited to the minimum necessary resources (least privilege). Location-based trust is a feature of traditional, perimeter-based security models, which Zero Trust is designed to replace.
Why Incorrect Options are Wrong
B. Enforcing multi-factor authentication (MFA) for every access request from the third party.
This is a core component of Zero Trust, as it strengthens identity verification for every access attempt, aligning with the "always verify" principle.
C. Implementing the principle of least privilege, restricting access to only the specific resources required for the contracted task.
This is a foundational pillar of Zero Trust. It minimizes the potential impact of a compromised account by strictly limiting a user's access to only what is essential.
D. Continuously monitoring and validating the security posture of third-party devices before granting access.
This reflects the dynamic and continuous verification aspect of Zero Trust, where trust is not a one-time event but is constantly assessed based on real-time signals.
References
1. National Institute of Standards and Technology (NIST). (2020). Special Publication 800-207: Zero Trust Architecture.
Section 2.1, Tenets of Zero Trust: "All communication is secured regardless of network location... Access to individual enterprise resources is granted on a per-session basis... Access to resources is determined by dynamic policy—including the observable state of client identity, application/service, and the requesting asset—and may include other behavioral and environmental attributes." This directly refutes the idea of a trusted network segment (Option A) and supports continuous validation (Option D).
2. The Shared Assessments Program. (2023). CTPRP Body of Knowledge.
Domain 4: Third Party Risk Management Controls, Section on Access Control: The curriculum emphasizes modern access control frameworks that move beyond perimeter security. It describes Zero Trust as a strategic approach where "no user or system is trusted by default." It explicitly contrasts this with legacy models that grant broad access once a user is on the "trusted" network, making Option A inconsistent with CTPRP teachings.
3. Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust Architecture. National Cybersecurity Center of Excellence (NCCoE), NIST.
Page 11, Section 3.1.1, Implicit Trust Zone: "In a ZTA, a trust zone is a discrete network segment that is assigned to a single logical owner... However, this does not mean that assets in the trust zone are implicitly trusted. All assets and subjects in the trust zone must have all access requests validated before access is granted." This publication clarifies that even within defined network segments, implicit trust is eliminated, directly invalidating the approach in Option A.
