Tools / Zero Trust Architecture (ZTA) Interview questions
What is the difference between identity-based and network-based segmentation?
Network-based segmentation ties access decisions to network location: IP address, VLAN, or subnet membership. If a host sits in the "trusted" subnet, it inherits that subnet's access rights regardless of what is actually running on it.
| Network-Based | Identity-Based |
| Access tied to IP/VLAN/subnet | Access tied to verified subject identity and attributes |
| Breaks when IPs change (cloud, containers) | Follows the workload regardless of IP changes |
| Coarse-grained, per-subnet policy | Fine-grained, per-user or per-workload policy |
Identity-based segmentation is generally preferred in Zero Trust because modern environments, autoscaling containers, ephemeral cloud instances, mobile users, make static network location an unreliable proxy for trust.
Network-based segmentation ties access decisions primarily to:
Identity-based segmentation is preferred in dynamic environments because it:
More Related questions...
