Question

A financial services company is implementing a zero trust architecture. Users connect from managed laptops and unmanaged personal devices to a mix of SaaS applications and internally hosted microservices. The security architect wants a design where access decisions are evaluated centrally using identity, device posture, and contextual risk signals, but enforcement happens as close as possible to each protected resource to prevent bypass. Which design approach best satisfies these requirements?

Accepted Answer

Centralize a Policy Decision Point that evaluates identity and posture signals, and distribute Policy Enforcement Points in front of each application and microservice

Answer

Deploy a single VPN concentrator at the perimeter that terminates all sessions and applies firewall rules based on source IP ranges

Answer

Configure each SaaS application and microservice to independently make and enforce its own access decisions using locally stored group membership

Answer

Route all traffic through a network TAP that logs sessions and alerts the SOC when anomalous access patterns are detected