You are creating a real-time policy for cloud applications. In addition to users, groups, and organizational units, which two source criteria would…

Real-time policies for cloud applications depend on a comprehensive understanding of the access request's context, a core principle of Zero Trust security. Beyond identifying the user (via users, groups, OUs), the policy engine must evaluate the risk associated with the connection itself. Access method (e.g., forward proxy, reverse proxy, API) and device classification (e.g., managed, unmanaged, compliant, non-compliant) are fundamental source criteria. These allow administrators to create granular rules, such as granting full access from a managed corporate device but limiting access to web-only with data loss prevention (DLP) controls from an unmanaged personal device.

A. protocol version: This is typically a global security setting to enforce a minimum standard (e.g., require TLS 1.2+), not a dynamic criterion used to differentiate access rights between users in real-time policies.

C. browser version: This is a specific attribute that is usually part of a more comprehensive device posture assessment, which falls under the broader and more appropriate category of device classification.

1. National Institute of Standards and Technology (NIST). (2020). Zero Trust Architecture (NIST Special Publication 800-207).

Section 3.3

"System Component: Policy Administrator": This section describes the policy administrator's role in establishing and/or shutting down communication paths. The policy decision point considers multiple attributes

including device health and identity. "The policy for a resource may require that the device be owned by the enterprise

or it may be a BYOD device... This is the device identity." This directly supports device classification (D) as a key criterion. The context of how the connection is made is implicit in the architecture

supporting access method (B).

2. Carnegie Mellon University

Software Engineering Institute. (2019). Cloud Access Security Broker (CASB) Top 10 Use Cases.

Section 2.2

"Use Case 2: Detect threats from compromised accounts": The document notes that CASBs analyze "a full range of context (e.g.

user

device

location

application

data)." The document further explains policies that differentiate access from managed and unmanaged devices

which directly corresponds to device classification (D). The method of enforcement (e.g.

reverse proxy for unmanaged devices) is a key part of the policy

supporting access method (B).

3. University of California

Berkeley. (2021). CS 161: Computer Security

Lecture 21: Cloud Security.

Lecture Notes

"Context-Aware Access Control": The courseware explains that modern cloud access controls move beyond static identity checks. Policy inputs are described as a tuple of (user

devicestate

location

accessmethod). This explicitly identifies device classification (D) (as devicestate) and access method (B) as core criteria for real-time policy evaluation in cloud environments.