zero trust
AI security interview questions tagged zero trust, across every topic.
6 questions · 0 unlocked for you
Concepts behind "zero trust"
Explanations of the mechanisms these questions rely on.
Core
Segmentation and Egress ControlNetwork controls matter most after initial compromise. Segmentation divides the network into zones with explicit, default-deny flows between them, from coarse zones (users, servers, management, sensitive data) to per-workload microsegmentation keyed on workload identity. Egress control limits outbound connections to what each system needs, breaking command-and-control, tool downloads, exfiltration and SSRF. Both are designed from observed flows, rolled out in monitor mode, kept as code with owners, and turned into detection by alerting on denied traffic. Network SecuritySign in
Core
Workload Identity and SPIFFE: Identity for Services, Pipelines and AgentsServices, CI jobs and AI agents have traditionally used long-lived stored keys, which leak and outlive their purpose. Workload identity replaces them with short-lived credentials issued after the platform attests what the workload is: Kubernetes projected tokens, OIDC tokens from CI exchanged for cloud credentials, and SPIFFE identities with X.509 or JWT documents for service-to-service mutual TLS. The design questions are which claims a trust policy pins, how attestation roots the chain, and remembering that identity is not authorization: every service still needs policy on what each identity may do. Identity & AccessSign in