Which capability of a Zero Trust network security architecture leverages the combination of application, user, and content identification to prevent unauthorized access?

The principle of least privilege is a core tenet of a Zero Trust architecture. This principle dictates that access is granted only to the resources an entity absolutely requires to perform its function, and no more. Palo Alto Networks' Next-Generation Firewalls implement this by creating granular security policies that leverage context from User-ID (who is the user?), App-ID (what application are they using?), and Content-ID (what kind of data is being transferred?). By combining these elements, the firewall can enforce precise access control rules, ensuring that only legitimate, authorized traffic is permitted, thereby preventing unauthorized access.

A. Cyber threat protection: This is a broader security outcome. While enforcing least privilege helps prevent threats, the specific capability of using user, app, and content to grant or deny access is access control.
B. Inspection of all traffic: This is a foundational requirement to enable identification, not the capability that leverages the identified information. Inspection is the mechanism; access control is the policy enforcement.
D. Network segmentation: This is an architectural approach for creating security zones (e.g., microsegments). Least privilege access control is the policy principle applied to traffic flowing between and within these segments.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "Components of a Security Policy Rule". This section details how Security policy rules are the basis for the firewall’s access control. It states, "A Security policy rule has a number of components that can be used as match criteria: ... User (source user), Application, ...". This directly links the identification of user and application to the creation of access control rules.

2. Palo Alto Networks. (n.d.). What Is Zero Trust? Palo Alto Networks Technology Documentation. Retrieved from https://www.paloaltonetworks.com/cyberpedia/what-is-zero-trust. Under the section "The Core Principles of Zero Trust," the document lists "Least-Privilege Access" as a fundamental principle, explaining that "Users are only given access to the resources they need to do their jobs, and nothing more." This is achieved by using context, including user and application identity.

3. National Institute of Standards and Technology (NIST). (August 2020). NIST Special Publication 800-207: Zero Trust Architecture. Section 2.1, "Tenets of Zero Trust," Tenet 4 states: "Access to resources is determined by dynamic policy—including the observable state of client identity, application/service, and the requesting asset—and may include other behavioral and environmental attributes." This foundational document confirms that access control policies in a Zero Trust model are based on the identity of the user and application.