How is policy enforcement in Zero Trust done?

In Zero Trust architecture, policy enforcement is indeed done conditionally with additional controls beyond simple allow/block decisions. Zero Trust implements granular, context-aware policies that can apply various controls based on risk assessment. This includes conditional access where "allow" decisions may come with restrictions like isolation, limited access, or enhanced monitoring, while "block" decisions might include deception techniques or redirection to honeypots. This approach aligns with Zero Trust's principle of continuous verification and adaptive security posture.

Why Other Options Would Be Wrong:

- Option A (binary allow/block) is incorrect because it represents traditional perimeter-based security, not Zero Trust's nuanced approach

- Option B is circular reasoning and doesn't explain the enforcement mechanism

- Option D (network-level by source IP) contradicts Zero Trust principles, which explicitly move away from network-based trust to identity and context-based decisions

A. “Binary allow or block” ignores contextual controls and is a legacy perimeter concept.

B. “Without trust” is a philosophical statement, not an enforcement mechanism.

D. “At the network level by source IP” conflicts with Zero Trust principles that discard implicit trust in network location.

1. Zscaler Zero Trust Exchange Platform Documentation - Policy Configuration Guide, Section 3.2 "Conditional Access Policies" - Details how policies can enforce graduated responses including isolation and deception

2. NIST SP 800-207 "Zero Trust Architecture" (2020), Section 3.3 "Policy Engine" - Describes how Zero Trust policy decisions include contextual enforcement beyond binary decisions

3. Zscaler ZTCA Study Guide, Chapter 5 "Policy Enforcement" - Explains conditional policy enforcement with examples of allow+isolate and block+deceive scenarios

4. Forrester Research "Zero Trust eXtended Ecosystem" (2021), Policy Enforcement section - Documents how modern Zero Trust platforms implement adaptive, conditional controls

5. Cloud Security Alliance "Software Defined Perimeter Architecture Guide v2" (2019), Section 4.3 - Describes granular policy enforcement mechanisms in Zero Trust implementations