Tools / Zero Trust Architecture (ZTA) Interview questions
How is risk-based or adaptive access control implemented in Zero Trust?
Risk-based access control computes a dynamic score from multiple context signals, such as an impossible-travel login, an unfamiliar device, an unusual time of day, or the sensitivity of the resource being requested, and maps that score to a graduated response rather than a flat yes or no.
A low-risk request might be allowed silently. A moderate-risk request might trigger step-up authentication, such as a fresh MFA prompt. A high-risk request might be denied outright or routed to human review.
Crucially, this scoring runs continuously, not just at login, so risk can escalate mid-session if new signals arrive, for instance if the session's IP address suddenly changes country partway through.
Risk-based access control differs from a static allow/deny model because it:
An example of a moderate-risk response in adaptive access control is:
More Related questions...
