Zero Trust Access and Network Security
What the domain tests
Whether you can replace network-location trust with identity-and-context-based access, using F5 BIG-IP Access Policy Manager (APM) and F5 Distributed Cloud capabilities, and whether you can explain what makes an access decision continuous rather than a one-time gate.
Core rules
- Three principles. Verify explicitly (every request authenticated and authorized from available signals), grant least privilege (just-in-time, per-application), and assume breach (segment, log, and limit blast radius).
- ZTNA vs VPN. A VPN grants network reachability; ZTNA grants application reachability through an identity-aware proxy. The application is never directly exposed, and the connector makes only outbound connections.
- APM building blocks. Access policies in the visual policy editor, per-request policies for resource-level re-evaluation, SSO via SAML/OIDC/OAuth, MFA, endpoint posture inspection, and session variables that carry context into logs.
- Context signals. User identity, group, device health (EDR running, disk encrypted, patched), location, time and risk score. Failed posture sends the user to remediation, not to the app.
- East-west. Microsegmentation and mTLS between workloads matter as much as north-south control; flat internal networks are the classic zero-trust gap.
Worked example
A contractor needs an internal HR application. The APM access policy requires IdP federation with MFA, checks device posture, restricts to approved countries, and issues a session. A per-request policy re-checks session validity and the requested resource on each call, so revoking the contractor takes effect immediately rather than at the next network reconnect. No VPN route to the HR subnet exists at all. Reasoning: the decision is per request and per resource, and reachability is scoped to one app.
Traps that cost marks
Calling an existing VPN zero trust because it requires MFA. Doing a posture check once at login and never again. Trusting anything inside the perimeter. Forgetting non-human identities and service accounts, which frequently hold standing privileges. Letting access policies sprawl without an owner or review cycle, which turns least privilege into permanent privilege.