Question

A financial services firm is deploying a zero trust access model for its SaaS applications. Users authenticate with phishing-resistant MFA, but the security architect notes that a device compromised after login retains its session and access for the full 8-hour token lifetime. The architect wants to ensure that access decisions reflect the real-time trustworthiness of the endpoint, not just the state at initial sign-in. Which design approach BEST addresses this gap?

Accepted Answer

Integrate the access broker with continuous device posture signals (EDR health, patch level, compliance state) so sessions are re-evaluated and revoked when the endpoint falls out of compliance

Answer

Reduce the access token lifetime to 15 minutes so compromised sessions expire quickly and users must re-authenticate frequently

Answer

Require certificate-based device authentication at login to guarantee only managed devices can establish a session

Answer

Deploy a VPN with always-on tunneling and inspect all traffic through a next-generation firewall before it reaches the SaaS applications