Learn to evaluate network security architectures. This simulation focuses on identifying the correct security model that enforces continuous identity verification to mitigate lateral movement threats.

CND (312-38) Network Defense Simulation

Network Scenario

A recent incident involved a compromised contractor workstation. The attacker successfully authenticated to the corporate VPN and, once inside, was able to pivot laterally to internal database servers without further authentication challenges. The enterprise is now migrating its network architecture to ensure that every access request, regardless of whether it originates from "inside" or "outside" the corporate perimeter, is strictly authenticated, authorized, and continuously validated for security posture.

Traffic & Logs

Legacy Network Log (Compromise)

[08:14:02] VPN-GW-01: Session Established - User: contractor_j
[08:14:15] CORE-FW: PERMIT - src: 10.100.5.20 (VPN) dst: 10.0.50.11 (HR_DB) port: 3306 [Rule: Allow_Internal_VPN]
[08:15:00] IDS-01: ALERT - Excessive SQL queries from VPN segment
[08:18:22] CORE-FW: PERMIT - src: 10.100.5.20 dst: 10.0.60.5 (FILE_SHARE) port: 445 [Rule: Allow_Internal_VPN]

New Architecture Log (Enforcement)

[10:16:05] ZTNA-Proxy: Access Request - User: contractor_j -> App: HR_DB
[10:16:05] IDP: Auth SUCCESS (MFA validated)
[10:16:06] POSTURE-CHK: FAIL - Device non-compliant (Missing EDR agent)
[10:16:06] ZTNA-Proxy: DENY - Implicit drop (Policy: HR_DB_Strict)
[10:16:10] ZTNA-Proxy: Access Request -> App: FILE_SHARE -> DENY (No explicit role assignment)

Question

Which of the following security models enable strict identity verification for every user or device attempting to access the network resources?

I. Zero-trust network model

II. Castle-and-Moat model

Expert Analysis

1. What is happening in the network

The legacy logs show a user connecting to the VPN and immediately gaining implicit trust to access multiple sensitive internal subnets (HR_DB and FILE_SHARE). The new architecture logs demonstrate a Zero Trust Network Access (ZTNA) proxy intercepting requests, validating identity (MFA), and strictly checking device posture before granting or denying access on a per-application basis.

2. Identify attack or behavior

Lateral movement. In perimeter-based networks, attackers who breach a single endpoint or VPN gateway can often move freely across the internal network because traffic inside the perimeter is trusted by default.

3. Why correct answer is correct

I only (Zero-trust network model). Zero Trust eliminates the concept of a trusted internal network. It requires strict identity verification, device posture checks, and least privilege access for *every* connection attempt, regardless of the user's physical or network location.

4. Why others are wrong

Castle-and-Moat: This is a legacy model that focuses on defending the perimeter (the moat). Once an entity gets past the firewall or VPN (inside the castle), they are generally trusted, which fails to provide "strict identity verification for *every* user or device attempting to access network resources."

5. Defensive action

Deploy an Identity-Aware Proxy (IAP) or ZTNA solution. Implement micro-segmentation, require MFA for all applications, and integrate Endpoint Detection and Response (EDR) telemetry to enforce device compliance policies before granting access.

Mini Lesson: Implicit vs Explicit Trust

Castle-and-Moat (Implicit Trust): Trust is based on IP address or network location. "You are on the internal VLAN, therefore you are trusted."

Zero Trust (Explicit Verification): Trust is based on context. "You must prove who you are (Identity), what you are using (Device Health), and you only get access to exactly what you need (Micro-segmentation/Least Privilege) for this specific session."

Explore more CND simulations

Get Full Practice Access