Design Zero Trust Architecture - System Design | WinJob

Problem Statement: Perimeter vs Zero Trust

Design a zero trust access platform for User → VPN → PEP → Service → SIEM where microsegmentation replaces VLAN trust: east-west traffic uses SPIFFE identities, PDP decisions, and default-deny unless policy explicitly allows.

Design anchors (1)

Policy Decision Point (PDP) evaluates ABAC rules on every request; Policy Enforcement Point (PEP) sidecars never embed static ACLs.
Device posture and user risk are first-class attributes—not optional headers bolted on after login.
mTLS + SPIFFE SVIDs identify workloads; human access uses OIDC with step-up for sensitive resources.

Mechanism

Control plane publishes immutable policy bundle v1 to PEP fleets. Data plane path: terminate TLS → validate SVID/JWT → fetch posture → call PDP → enforce allow/deny → emit structured decision event. Deny wins on tie; unknown attributes fail closed.

Failure drills

If PDP shard is unavailable, PEP uses last-known bundle with 30s max staleness then fails closed for financial APIs. If SPIRE issuance stalls, workloads drain via health checks—no silent plaintext fallback. If posture feed lags >60s, step-up auth for admin consoles.

Cost and capacity

At Every hop Auth checks, budget None for PDP CPU and Deny for Kafka audit egress. Cache 100% at PEP to absorb hot read paths without widening stale-allow windows.

Signal	Target
Auth checks	Every hop
Trust zone	None
Default	Deny
Audit	100%

javaOne Dark Pro

1 public record ZtDecision(String subject, String resource, String action, boolean allow, String policyBundle) {
2   public boolean failClosed() { return !allow || policyBundle == null; }
3 }

pythonOne Dark Pro

1 def pep_should_call_pdp(cache_hit: bool, resource_sensitivity: str) -> bool:
2     if resource_sensitivity == "critical":
3         return True
4     return not cache_hit

typescriptOne Dark Pro

1 export interface AccessContext {
2   subjectId: string;
3   devicePosture: "healthy" | "stale" | "unknown";
4   riskScore: number;
5 }
6  
7 export function defaultDeny(ctx: AccessContext): boolean {
8   return ctx.devicePosture === "unknown" || ctx.riskScore > 80;
9 }

Why interviewers care

Zero Trust Architecture interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement: Perimeter vs Zero Trust that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Problem Statement: Perimeter vs Zero Trust
•Metrics: Auth checks, Trust zone, Default, Audit
•PEP/PDP separation

1	public record ZtDecision(String subject, String resource, String action, boolean allow, String policyBundle) {
2	public boolean failClosed() { return !allow \|\| policyBundle == null; }
3	}

1	def pep_should_call_pdp(cache_hit: bool, resource_sensitivity: str) -> bool:
2	if resource_sensitivity == "critical":
3	return True
4	return not cache_hit

1	export interface AccessContext {
2	subjectId: string;
3	devicePosture: "healthy" \| "stale" \| "unknown";
4	riskScore: number;
5	}
6
7	export function defaultDeny(ctx: AccessContext): boolean {
8	return ctx.devicePosture === "unknown" \|\| ctx.riskScore > 80;
9	}