Tools / Zero Trust Architecture (ZTA) Interview questions
Why is device identity as important as user identity in Zero Trust?
A well-authenticated user on a compromised or non-compliant device can still cause serious harm; malware, unpatched vulnerabilities, or an unmanaged BYOD device can undermine even flawless user credentials. If a policy decision only checked the user, it would miss this entire risk category.
By binding the trust decision to both user identity and device identity, typically enforced via a device certificate or attestation, Zero Trust closes the gap where valid user credentials from an untrusted device would otherwise be enough to gain access.
In practice, this means a login with perfect credentials from a jailbroken phone or an unmanaged personal laptop can still be denied or restricted, because the device side of the identity pair failed to meet policy.
More Related questions...
