Study. uk . com
  1. Home
  2. All questions
  3. Question 206

CISSP study material · question 206 of 500

A gateway grants access whenever the user presents valid credentials, without examining the device the request came from. Which two zero trust points does this miss? Choose two.

  1. The asset's security posture must be evaluated before the request is granted.
  2. Evaluation of the device may be performed once per day rather than per session.
  3. Subject credentials alone are insufficient to authenticate the device to the resource.
  4. Device authentication is only required for personally owned devices.
Show the answer

Answer: C. Subject credentials alone are insufficient to authenticate the device to the resource.
A. The asset's security posture must be evaluated before the request is granted.

Every asset must have its posture evaluated by an enforcement point before access is granted and continually through the session; the subject's credentials do not authenticate the device.

Source: NIST SP 800-207 (NIST) — SP 800-207 > 2.2 A Zero Trust View of a Network, assumption 3

Challenge yourself on this topic → Study as cards