IT PATH
My Path

Security Architecture and Zero Trust

Design layered enterprise architecture where identity, segmentation, and verification replace implicit network trust.

Certification
CompTIA SecurityX
Recommended study time
6h 35m
Status
Not started

Recommended study time

About 6h 35m in total, measured from the material on this page. At your session length of 45 minutes that is 9 sittings.

  • Read the lesson21 min

    About 2,669 words at a careful technical reading pace.

  • Second pass with notes13 min

    Re-read the harder parts and write your own notes.

  • Recall from memory12 min

    2 written recall questions.

  • Practice decision12 min

    One applied decision with feedback.

  • Teach it back20 min

    Write the topic in your own words.

  • Real-world scenario15 min

    Read the situation and justify your decision in writing.

  • Hands-on practice3h 20m

    Labs, commands and configuration until you can do it unaided.

  • Spaced review1h 40m

    4 short review sessions spread over the following weeks.

Learning objectives

  • Apply zero-trust principles to a concrete enterprise design.
  • Balance security architecture against usability, cost, and legacy constraints.
  • Evaluate an architecture for single points of trust and failure.

Start here

About 8 minutes of reading, in 10 short parts.

Security architecture is the set of deliberate design decisions that determine whether a single compromised laptop stays contained or leads to total loss. Zero trust is the specific principle underlying modern architecture: no network location, including 'inside the building', should ever imply trust by itself.

Where you meet it: An architect redesigning remote access after an industry breach has to decide whether to replace a full-network VPN with per-application access, and defend that decision to a budget committee.

The lesson, part by part

Open one part at a time. Each part stands on its own, so you can stop and come back.

Old-style network security worked like a castle with one big wall and one gate: once a visitor got past the gate, they could wander freely through every room. Zero trust is like redesigning that castle so every single room has its own locked door and its own guard who checks identification again, regardless of how the visitor got into the building in the first place.

This sounds inconvenient, and it is more work to set up, but it means that if one visitor turns out to be an impostor, they are stuck in the one room they were checked into, rather than able to walk into the treasury just because they got past the front gate. Architecture is the discipline of designing that layout on purpose, rather than discovering the flat, open floor plan only after something goes wrong.

Key ideas

If you remember nothing else from this topic, remember these.

  • Zero trust assumes no implicit trust based on network location and requires continuous verification of identity and device posture for every request.
  • Micro-segmentation limits lateral movement by enforcing least-privilege network access between individual workloads rather than broad network zones.
  • A policy decision point and policy enforcement point architecture separates the logic of an access decision from where it is technically enforced.
  • Defense in depth layers multiple independent controls so a single failure does not lead directly to compromise.
  • Legacy perimeter-based architecture assumes internal network traffic is trustworthy, which zero trust explicitly rejects.
  • Security architecture decisions must balance usability, cost, and risk reduction rather than pursuing maximum control regardless of business impact.

Migrating a flat internal network toward zero trust

A worked example, step by step.

A company's internal network allows any authenticated device to reach any internal server once connected to the corporate VPN, and a recent incident showed lateral movement across the entire network from one compromised laptop.

  1. 01Assess current stateDocument that the VPN grants broad Layer 3 access to the entire 10.0.0.0/16 internal range once connected, with no per-application authorization check.
  2. 02Define protect surfacesIdentify the smallest set of critical assets to protect first: the finance database, HR system, and source code repository, rather than attempting the entire network at once.
  3. 03Establish identity as the control planeRequire device posture checks (patched OS, EDR agent present) and user identity verification via SSO with MFA before any access decision is made, replacing IP-based trust.
  4. 04Deploy policy enforcement pointsPlace software-defined micro-segmentation agents in front of the finance database and source code repository, enforcing per-application access policy rather than network-wide reachability.
  5. 05Implement continuous verificationConfigure session re-evaluation so that a device failing a posture check mid-session, such as EDR being disabled, has access revoked immediately rather than only at initial login.
  6. 06Test with the same attack scenarioSimulate the earlier incident's lateral movement technique (T1021 Remote Services) from a test compromised laptop and confirm the micro-segmentation policy blocks reaching the finance database.
  7. 07Expand incrementallyRoll the same model out to the next tier of protect surfaces over subsequent quarters, avoiding a risky single big-bang migration.
  8. 08Measure outcomeDocument that a repeat of the original incident's blast radius would now be limited to the initially compromised device, not the entire internal network.

Outcome: The organisation replaces implicit network trust with continuous identity and device verification for its most critical assets, measurably reducing lateral movement blast radius without disrupting daily user workflows.

Security architecture and zero trust reference

Worth keeping at hand while you work.

Zero trust
Model assuming no implicit trust regardless of network location
PDP
Policy Decision Point, evaluates access requests against policy
PEP
Policy Enforcement Point, technically enforces the access decision
Micro-segmentation
Fine-grained network isolation between individual workloads
Defense in depth
Layering multiple independent controls to avoid single points of failure
Protect surface
The specific critical asset being defended, smaller than the full attack surface
Continuous verification
Ongoing reassessment of identity and device posture during a session
T1021
Remote Services, a common lateral movement technique
SASE
Secure Access Service Edge, combining networking and security as a cloud service
Least privilege
Principle of granting only the minimum access needed for a task
Device posture check
Verification of device health, such as patch level or EDR presence, before granting access

Common misunderstandings

What most beginners get wrong here.

  • Zero trust means removing all trust and blocking everything by default forever.

    Zero trust means removing implicit trust based on network location, replacing it with continuous, explicit verification, not a permanent lockout.

  • A VPN alone implements zero trust.

    A traditional VPN grants broad network access once connected, which is the opposite of the per-request verification zero trust requires.

  • Zero trust must be implemented across the entire network at once.

    A phased approach starting with the smallest critical protect surfaces is the recommended and more achievable path.

  • Micro-segmentation and network segmentation are the same thing.

    Traditional segmentation divides broad zones, while micro-segmentation enforces least-privilege policy between individual workloads.

  • Once a user authenticates, their access should remain valid for the whole session regardless of changes.

    Continuous verification requires re-evaluating posture during a session and revoking access if conditions change, such as EDR being disabled.

Exam traps

How the question writers try to catch you out.

  • CASP+ and CySA+ scenarios test distinguishing the policy decision point from the policy enforcement point in a zero trust architecture diagram.
  • Expect questions where a legacy perimeter model is described and you must identify zero trust principles being violated, such as implicit trust of internal traffic.
  • Exam items test that a phased protect-surface approach, not a full network overhaul, is the recommended zero trust implementation strategy.
  • Watch for defense in depth questions asking you to identify a single point of failure across otherwise layered controls.
  • Questions may test that continuous verification, not one-time login authentication, is a defining requirement of zero trust.

Check yourself

Answer in your head first, then reveal. This is not scored.

  • What is the core assumption zero trust rejects?

  • What is the difference between a policy decision point and a policy enforcement point?

  • How does micro-segmentation differ from traditional network segmentation?

  • Why should zero trust be implemented in phases starting with protect surfaces?

  • What does continuous verification add beyond one-time login authentication?

  • What ATT&CK technique does micro-segmentation directly help contain?

Quick reference

A condensed summary of the lesson above, for revision.

What It Is

Zero trust assumes no network location confers trust. Every access request is authenticated, authorised against policy, and evaluated with device and context signals, with least privilege and continuous verification. Enterprise architecture applies this across identity, endpoints, networks, applications, and data, layered so a single failure is survivable.

Why It Matters

Flat, perimeter-based designs turn one compromise into total loss. Architectural decisions determine whether an intrusion is contained in an hour or becomes a company-defining event, and they are far cheaper to make early.

How It Works

  • Access requests are evaluated by policy engines using identity, device, and context signals.
  • Enforcement points sit close to resources rather than only at the network edge.
  • Segmentation and tiering restrict what any single compromised identity can reach.

Where You See It

  • Enterprise architecture reviews, cloud landing zones, remote access redesign, and merger integration.

Key Terms

Policy enforcement point
Where an access decision is applied.
Microsegmentation
Fine-grained isolation between workloads.
Device posture
Health and compliance signals used in access decisions.
Blast radius
The extent of damage a single compromise can cause.
Trust boundary
The line where assurance changes and verification is required.

Examples

  • Per-application access replaces a full-network VPN, so a compromised laptop cannot scan the estate.
  • Tiered administration prevents a helpdesk workstation from being able to authenticate to a domain controller.

Common Problems

  • Legacy applications without modern authentication
  • Standing privileged access
  • Flat internal networks
  • Inconsistent policy across cloud and on-premises

How It Fails

  • Exceptions granted for legacy systems quietly become the standard path.
  • Policy applied only to new cloud services leaves the legacy estate untouched.
  • Overly strict design without usability planning drives users to unmanaged workarounds.

How to Troubleshoot

  1. Trace an access path end to end and identify where trust is assumed rather than verified.
  2. Test whether a compromised endpoint could reach critical systems directly.
  3. Review exceptions on a schedule and require expiry dates.

Practical Knowledge

  • Sequence architecture work by blast-radius reduction rather than by product availability.
  • Design with the operations team; unusable controls are bypassed within weeks.

Exam Coverage

  • Zero trust principles and components
  • Enterprise security architecture
  • Trade-offs and legacy integration

Interview Questions

  • What would you change first in a flat network with VPN-based remote access?
  • How do you handle legacy applications in a zero-trust design?

Watch and read

Verified official and reputable sources for this topic. Links open in a new tab.

Video training

  • Professor Messer video channel — general CompTIA training (no dedicated CompTIA SecurityX course)

    Professor Messer

    Video
    Free
    Watch

Lesson notes and bookmark

Notes and bookmarks for this lesson, saved with everything else you have marked.

No notes on this item yet.

Learning progress

0% across six evidence areas. Reading alone does not change progress.

Understanding0%
Recall0%
Application0%
Practical ability0%
Troubleshooting0%
Retention0%

Prerequisites

Next steps

  1. 01Diagram one business service and mark every implicit trust relationship.
  2. 02Identify the largest blast radius in your current environment and how to reduce it.