Would you rely on VPNs and static credentials, or how do you architect a Zero Trust identity system for a globally distributed workforce accessing highly sensitive cloud workloads?
Assessing the architectural transition from legacy perimeter models to Zero Trust, focusing on continuous authentication, context-aware access, and the elimination of static credentials. Use this security answer to show the decision, trade-off, and evidence rather than a memorised definition. It also connects cloud security to the point an interviewer is testing.
What the interviewer is scoring
- That they enforce strong, phishing-resistant multi-factor authentication (MFA).
- Whether they utilise device posture and context-aware signals for access decisions.
- Does the candidate eliminate long-lived, static credentials in favour of ephemeral tokens?
- Whether the candidate implements continuous authorisation rather than relying on one-time login checks.
Answer
Short answer
Assessing the architectural transition from legacy perimeter models to Zero Trust, focusing on continuous authentication, context-aware access, and the elimination of static credentials.
The illusion of trust after the VPN gateway
The traditional hub-and-spoke VPN architecture is a liability in a modern, distributed, multi-cloud environment. The trap is continuing to rely on a hardened network perimeter, assuming that anyone who has authenticated past the VPN gateway is implicitly trustworthy. This perimeter-based approach guarantees that a single compromised developer endpoint immediately grants attackers lateral movement capabilities across internal networks. Relying on one-time authentication checks and static credentials to secure highly sensitive financial data or production pipelines is an architectural failure waiting to happen.
Deprecating the network perimeter
A true Zero Trust architecture operates on the mandate of "Never Trust, Always Verify." It requires the complete deprecation of legacy VPN infrastructure. Access must instead route through an Identity-Aware Proxy (IAP) or a Zero Trust Network Access (ZTNA) solution. This single choke point abstracts the network layer entirely; applications are no longer exposed directly to the internet or an internal corporate network, but are shielded behind a gateway that mandates authentication and authorisation for every single request.
Multi-Factor Authentication (MFA) must be strictly enforced, but not all MFA is equal. The architecture must mandate phishing-resistant mechanisms—FIDO2-compliant hardware security keys or platform authenticators—explicitly banning weaker, easily intercepted methods like SMS-based OTPs or push notifications.
Context-aware authorisation as the baseline
Authentication is only the first step; static authentication is insufficient. The architecture must evaluate context dynamically. A central policy engine must integrate the Identity Provider (IdP) with Mobile Device Management (MDM) and Endpoint Detection and Response (EDR) solutions. Access decisions must evaluate device posture. If a request originates from an unmanaged device, or a corporate machine with an outdated OS or an active malware alert, the request must be denied—even if the credentials and MFA are valid.
flowchart TD
A["User / Device"] --> B["Identity Aware Proxy (IAP)"]
B --> C{"Policy Engine"}
C -->|Evaluates| D["User Identity & MFA"]
C -->|Evaluates| E["Device Posture (MDM)"]
C -->|Evaluates| F["Context (Location, Time)"]
C -- "Authorised" --> G["Ephemeral Credential Broker"]
C -- "Denied" --> H["Reject Request & Log"]
G --> I["Target Cloud Workload"]The eradication of static credentials
Long-lived static credentials—SSH keys, database passwords, and API tokens—are the primary currency of lateral movement. They must be systematically eradicated. Infrastructure access requires a short-lived certificate authority system. Engineers authenticate against a Zero Trust broker, which issues an ephemeral, short-lived cryptographic certificate scoped strictly to the target resource and valid only for the duration of the task.
This ephemeral access model must extend to the cloud control plane (using temporary STS tokens) and databases (utilising dynamic secrets management to generate time-bound credentials on the fly). Furthermore, authorisation must be continuous. If a user's risk profile changes mid-session—due to anomalous endpoint behaviour or a status change in HR systems—active sessions must be immediately revoked. Comprehensive observability, routing all access logs to a SIEM for anomalous pattern detection, is the final necessity.
A true Zero Trust architecture shifts the security perimeter from the network edge to the identity and the endpoint, requiring continuous, context-aware authorisation and the absolute elimination of static, long-lived credentials.
© 2026 Preptima. Originally published at preptima.com.
Likely follow-ups
- How do you handle a legitimate emergency where an engineer needs break-glass access to a production workload but their device posture check is failing?
- How does the policy engine's decision latency change as you onboard thousands of additional applications behind the identity-aware proxy, and where would that latency start to hurt?
- If the identity provider itself is compromised, how do the ephemeral credential broker and continuous authorisation checks limit what an attacker can do with a forged identity?
Related questions
- How do you design a highly available envelope encryption architecture that protects billions of records without exhausting KMS API limits or crushing latency?hardAlso on security and architecture3 min
- A customer reports seeing another company's records in your admin console. Walk me through the first hour, and then tell me what you change so this class of bug cannot happen again.hardAlso on security4 min
- How do you implement dynamic PII masking across a highly decentralised data mesh without destroying the analytical utility of the data for downstream machine learning workloads?hardAlso on security2 min
- How do you execute the Inverse Conway Maneuver on a 200-person engineering org that accidentally built a distributed monolith mirroring their dysfunctional silos?hardAlso on architecture3 min