I85PREP
⌘ K
CSA CCZT study materials
CSA CCZT study resources

CSA CCZT: Zero Trust Foundational Concepts

CSA CCZT · Work through your exam, one topic at a time.

All guide sections

Zero Trust Foundational Concepts

Zero Trust Foundational Concepts is the vocabulary and principles domain. The exam tests definitions, the origin and intent of zero trust, the relationship among zero trust, ZTNA, SDP, and microsegmentation, and the core assumptions that separate zero trust from perimeter security.

Core rules

  • Zero trust is a set of principles, not a product or a single architecture: no implicit trust based on network location; verify explicitly; least privilege; assume breach.
  • John Kindervag popularized zero trust in 2010; NIST SP 800-207 (2020) standardized the architecture language. The phrase is 'never trust, always verify,' not 'trust nothing.'
  • Every request is authenticated and authorized before access, ideally per session and per resource. Identity, device, and context replace network location as the basis for trust.
  • Microsegmentation limits east-west movement; ZTNA and SDP are access architectures; SASE converges network and security services. These are implementations, not synonyms for zero trust.
  • The CISA maturity model's pillars-Identity, Devices, Networks, Applications & Workloads, Data-are a useful map of the control surface.
  • Zero trust assumes the enterprise is already compromised somewhere; detection, telemetry, and containment matter as much as prevention.

Worked example

An employee on the corporate LAN opens the finance database. Under a perimeter model, the LAN location might grant access. Under zero trust, the request goes to a PEP; the PE checks the user's role, MFA status, device compliance, and the data's classification. The employee gets read-only, time-bound access to the specific database, not the whole finance subnet. The reasoning: the corporate network is not a credential. The same policy applies at headquarters, at home, or on a hotel Wi-Fi.

Traps that cost marks

  • Defining zero trust as 'trust nothing' or as a vendor product.
  • Using zero trust, ZTNA, SDP, and microsegmentation interchangeably.
  • Believing a VPN or firewall automatically delivers zero trust.
  • Forgetting that identity, device posture, and data classification are prerequisites, not optional extras.