PERFORMANCE-BASED QUESTION

Secure Design & Zero Trust Classification

Scenario: For each described mechanism or principle, identify which secure-design concept it represents. Note: Each description maps to exactly one concept.

Security+ SY0-701 Domain 1.2 — Fundamental Security Concepts 8 Items

0/8 items answered

Instructions: For each mechanism or principle in the table below, select the secure-design concept it represents. Every row must have a selection before you can submit. Use the reference panel on the right if you need a quick definition of each concept.

Secure Design Classification Matrix

Mechanism / Principle	Secure Design Concept

Verification

All 8 items must be correctly classified to pass.

0/8

items correctly classified

items correct (of 8)

Zero Trust Concepts

Zero Trust — Policy Engine

The decision-making component that evaluates policy rules and contextual signals (identity, device health, location) and grants or denies each access request. It reasons about trust but does not sit in the traffic path.

Zero Trust — Policy Enforcement Point

The component that physically sits between the subject and the resource and acts on the Policy Engine's decision by allowing or blocking the session in real time throughout its lifetime.

Zero Trust — Adaptive Identity

A Zero Trust practice in which trust is never static: identity and risk signals are continuously re-evaluated during a session, and authentication is stepped up when posture, location, or behavior changes.

Secure Design Principles

Defense in Depth

Stacking multiple independent, overlapping controls so that the failure of any single layer does not expose the asset (e.g., firewall + IDS + EDR + MFA).

Least Privilege

Granting each user, service, or process only the minimum access rights required to perform its function and nothing more, reducing the blast radius of a compromise.

Separation of Duties

Requiring two or more different individuals to complete a sensitive task so that no single person can commit fraud, error, or abuse alone (dual-control principle).

Deception & Disruption

Deliberately planting fake systems, files, or credentials (honeypots, honeytokens) that have no legitimate use; their only purpose is to lure, detect, and slow down attackers.

Fail-Secure / Secure Defaults

Designing systems so that failures default to the most secure outcome (deny access, close the connection) rather than an open or permissive state.

Exam Strategy

Policy Engine vs. Enforcement Point

The Policy Engine decides; the Policy Enforcement Point enforces. If the description mentions "sitting in the traffic path" or "blocking the connection," it is the PEP. If it mentions "evaluating signals and deciding," it is the PE.

Least Privilege vs. Separation of Duties

Least Privilege is about restricting access scope for one principal. Separation of Duties is about requiring multiple people to complete one action.

Fail-Secure tell

Look for language about what happens when a control breaks or a system crashes. If the answer is "deny / block / close," that is fail-secure.