CISSP Communication and Network Security Practice Question
A security team is implementing a zero trust architecture. Which component is essential to enforce access decisions based on user identity, device posture, and context before granting access to resources?
⚠ Common exam trap
A common mix-up: candidates confuse Network Access Control (NAC) with zero trust because both involve device posture checks, but NAC is a pre-admission network-level control, whereas SDP provides per-session, application-level access control that is fundamental to zero trust architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Software-defined perimeter (SDP)
A software-defined perimeter (SDP) is the essential component for enforcing access decisions based on user identity, device posture, and context in a zero trust architecture. SDP creates a dynamic, encrypted micro-perimeter around each resource, requiring authentication and authorization before any connection is established, effectively hiding the resource from unauthorized users. This aligns with the zero trust principle of 'never trust, always verify' by evaluating identity, device health, and contextual factors (e.g., location, time) before granting access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Virtual private network (VPN)
Why it's wrong here
While Virtual Private Networks (VPNs) establish encrypted tunnels for secure remote access, they typically operate on a 'trust once connected' model, granting users broad access to an entire network segment or subnet after initial authentication. This approach directly contradicts zero trust principles, which demand continuous, granular, and per-request authorization to specific resources rather than wide network access.
- ✗
Network Access Control (NAC)
Why it's wrong here
Network Access Control (NAC) solutions primarily enforce security policies for devices attempting to connect to the network, ensuring they meet specific posture requirements before granting initial network admission. However, NAC's focus is largely on pre-admission or segment-based control, whereas zero trust requires continuous, context-aware authorization for every access request to any resource, irrespective of the device's initial network access status.
- ✗
Next-generation firewall (NGFW)
Why it's wrong here
Next-generation firewalls (NGFWs) provide advanced capabilities like deep packet inspection, intrusion prevention, and application awareness, enhancing traditional perimeter security. While NGFWs can enforce some policies based on user groups or applications, they fundamentally operate at the network layer and lack the fine-grained, identity-centric, and continuous context-aware authorization required by zero trust for individual resource access, which extends beyond network perimeters.
- ✓
Software-defined perimeter (SDP)
Why this is correct
A Software-Defined Perimeter (SDP), often referred to as Zero Trust Network Access (ZTNA), dynamically creates a secure, individualized network segment between a user/device and the specific application or resource they are authorized to access. It authenticates and authorizes every user and device before granting access to any resource, effectively making resources invisible to unauthorized entities and embodying the core tenets of zero trust by enforcing least privilege access.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.