CAS-004 Security Architecture Practice Question
A security architect is designing a zero trust architecture for a financial services company. Which component is MOST critical to enforce identity-centric access control in a zero trust model?
⚠ Common exam trap
The trap is confusing network security appliances (firewalls, IPS, VPNs) with identity-centric access control mechanisms; candidates must recognize that zero trust requires an identity-aware proxy or SDP, not just perimeter defenses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Software-defined perimeter
A software-defined perimeter (SDP) is the most critical component for enforcing identity-centric access control in zero trust because it creates a 'black cloud' where resources are invisible until users and devices are authenticated and authorized. SDP uses a controller that brokers connections based on identity, device posture, and policy, rather than network location. This directly implements the zero trust principle of 'never trust, always verify' at the access layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network firewall
Why it's wrong here
A network firewall filters traffic by IP address and port, which are location-based signals rather than identity, so it cannot enforce identity-centric access control. It is tempting because firewalls are foundational security devices, and this would be correct for a question about perimeter segmentation.
- ✗
Intrusion prevention system
Why it's wrong here
An intrusion prevention system detects and blocks malicious traffic patterns, but it does not authenticate users or authorise access based on identity. It is tempting because IPS is a core network defence control, and this would be correct for a question about detecting and stopping exploits rather than enforcing identity-centric access.
- ✓
Software-defined perimeter
Why this is correct
A software-defined perimeter creates identity-based, need-to-know network segments, so access to resources is granted per user and device rather than by network location. This enforces identity-centric control, satisfying zero trust's requirement that trust be continuously verified before any connection is established.
- ✗
VPN concentrator
Why it's wrong here
A VPN concentrator grants network-level access once a tunnel is established, which is location-based rather than identity-centric and conflicts with zero trust's per-request evaluation. It is tempting because VPNs secure remote connectivity, and this would be correct for a question about encrypted remote access rather than identity-centric control.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.