Trusted application prosecution initiates () verification to the zero-trust agent.

Question

Options

• AUser Tokens and Application Tokens
• BApplication Token
• CUser token

• A
  76% (31)
• B
  15% (6)
• C
  10% (4)

Explanation

Option A is correct because zero-trust architecture enforces the principle of "never trust, always verify" for every entity involved in a transaction - meaning both the user's identity and the application's identity must be independently verified before access is granted. When a trusted application initiates communication with a zero-trust agent, it must present both a User Token (proving who is operating the application) and an Application Token (proving what application is making the request), giving the zero-trust agent full context to make an access decision.

Option B (Application Token only) is incomplete - knowing which app is running doesn't tell the agent who is using it, leaving user identity unverified. Option C (User Token only) is equally incomplete - knowing who the user is doesn't confirm which application is acting on their behalf, which could allow a malicious or unauthorized app to piggyback on a valid user identity.

Memory tip: Zero Trust = Double Check. Always ask WHO (User Token) + WHAT (Application Token) - one without the other leaves a blind spot that zero trust is specifically designed to eliminate.

No community discussion yet for this question.