I85PREP
⌘ K
CSA CCZT study materials
CSA CCZT study resources

CSA CCZT: Zero Trust Architecture

CSA CCZT · Work through your exam, one topic at a time.

All guide sections

Zero Trust Architecture

Zero Trust Architecture (ZTA) is the structural domain of the CCZT exam: how NIST SP 800-207 turns zero trust principles into concrete components and traffic flows. Questions typically test the seven tenets, the policy engine/administrator/enforcement point split, and the deployment patterns that place enforcement near the resource.

Core rules

  • NIST SP 800-207 defines ZTA as an enterprise architecture built on zero trust principles: no implicit trust from network location, per-request authentication and authorization, least privilege, and assume-breach thinking.
  • The seven tenets: all data sources and computing services are resources; all communication is secured regardless of location; access is granted per session; policy is dynamic and uses identity, device, behavior, and environmental signals; asset integrity is monitored; authentication and authorization are strictly enforced before access; telemetry is collected to improve posture.
  • Core components: the Policy Engine (PE) decides access; the Policy Administrator (PA) establishes or tears down the connection and issues credentials; the Policy Enforcement Point (PEP) enables, monitors, and terminates the session. PE plus PA form the Policy Decision Point.
  • Deployment patterns include device-agent/gateway, enclave gateway, resource portal, application proxy, and device sandboxing. The choice depends on legacy support, data sensitivity, and whether the device is managed.

Worked example

A contractor on a personal laptop requests the HR portal from a coffee shop. A PEP at the reverse proxy intercepts the request. The PE evaluates identity (MFA satisfied), device posture (unmanaged, encryption unknown), resource sensitivity (PII), and time/geography. Policy grants read-only browser access without download; the PA provisions a short-lived token; the PEP opens a per-session tunnel and logs the decision. When posture changes mid-session, access is revoked at the next check. The reasoning: trust is computed per request, not inherited from a VPN or office network.

Traps that cost marks

  • Equating ZTA with a VPN replacement or a single gateway product.
  • Confusing PA and PEP roles; the PA does not inspect packets.
  • Treating 'trust but verify' as a tenet. The tenet is no implicit trust.
  • Assuming traffic inside the perimeter is trustworthy.