Chapter 58: Zero Trust, SASE, NAC, and Segmentation
This chapter follows the topics shown in the Networking chapter menu. Work through each section in order, then use the review questions to check recall and troubleshooting reasoning.
58.1 Zero Trust
Zero Trust assumes network location alone is not sufficient evidence of trust. Access decisions should verify identity, device state, context, and least-privilege policy.
Scenario: a user reports a problem related to Zero Trust. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.2 Traditional Perimeter Security
Traditional Perimeter Security is a network-security concept. A sound design identifies the protected asset, trust boundary, possible abuse path, preventive controls, detection signals, and recovery steps.
Scenario: a user reports a problem related to Traditional Perimeter Security. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.3 Verify Explicitly
Verify Explicitly is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Verify Explicitly. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.4 Least Privilege
Least Privilege is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Least Privilege. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.5 Microsegmentation
Microsegmentation is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Microsegmentation. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.6 Lateral Movement
Lateral Movement is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Lateral Movement. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.7 NAC
Network Access Control evaluates who or what is connecting and can apply admission, role, segmentation, or quarantine decisions.
Scenario: a user reports a problem related to NAC. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.8 Posture Assessment
Posture Assessment is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Posture Assessment. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.9 Quarantine VLAN
A VLAN creates a logical Layer 2 broadcast domain on switching infrastructure. Traffic between VLANs requires a Layer 3 forwarding function.
Example: users in VLAN 20 can communicate with one another through switches, but reaching VLAN 30 requires a Layer 3 gateway. If one trunk omits VLAN 20, only paths crossing that trunk fail.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.10 802.1X
802.1X is a port-based network access-control framework involving a supplicant, an authenticator, and an authentication server, commonly using EAP and RADIUS.
Scenario: a user reports a problem related to 802.1X. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.11 Supplicant
Supplicant is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Supplicant. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.12 Authenticator
Authenticator is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Authenticator. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.13 Authentication Server
Authentication Server is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Authentication Server. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.14 RADIUS
RADIUS centralizes authentication, authorization attributes, and accounting for many network-access use cases such as Wi-Fi, VPN, and 802.1X.
Scenario: a user reports a problem related to RADIUS. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.15 SASE
SASE combines wide-area connectivity with cloud-delivered security services so access policy can follow users, devices, applications, and locations.
Scenario: a user reports a problem related to SASE. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.16 SSE
SSE is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to SSE. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.17 ZTNA
ZTNA is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to ZTNA. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.18 VPN vs ZTNA
A VPN creates a protected logical connection across an untrusted or shared network. The design must define endpoints, authentication, encryption, routing, and failure behavior.
Example: two sites can reach the public internet but cannot pass private traffic through the secure tunnel. Check peer reachability, negotiation state, authentication, encryption proposals, interesting traffic, NAT interaction, routes, and policy.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.19 Secure Web Gateway
Secure Web Gateway is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Secure Web Gateway. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.20 CASB
CASB is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to CASB. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.21 DLP
DLP is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to DLP. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.22 Guest Segmentation
Guest Segmentation is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Guest Segmentation. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.23 IoT Segmentation
IoT Segmentation is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to IoT Segmentation. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.24 Management Segmentation
Management Segmentation is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Management Segmentation. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.25 Air Gaps
Air Gaps is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Air Gaps. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.26 Honeypots
Honeypots is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Honeypots. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.27 Honeynets
Honeynets is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Honeynets. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.28 Jump Boxes
Jump Boxes is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Jump Boxes. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.29 Bastion Hosts
Bastion Hosts is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Bastion Hosts. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
58.30 Authentication vs Authorization
Authentication vs Authorization is one of the core topics in Zero Trust, SASE, NAC, and Segmentation. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Authentication vs Authorization. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.