Zero › Module 6 › Lesson 1
ZTNA Named
Zero Trust Network Access (ZTNA) literacy — app-specific access without flat VPN — ZTNA architecture card on YOUR $ZT_LAB network folder.
Visual · t40_ztna_named
ZTNA named. $ZT_LAB. Original Cyberlium.
Opening
VPN is a tunnel — ZTNA is a door per app — name broker, connector, and policy path on LAB-ZT-001 before vendor PoC slides.
ZTNA (Zscaler Private Access, Prisma Access, Cloudflare Access, Entra global secure access literacy) publishes apps via cloud broker; user+device verified per session; no full network layer access by default. Document ZTNA card: broker, app catalog, connector/agent, IdP integration, logging — fictional LAB-ZT-001. Next: SASE Named.
1. ZTNA components (named)
Client/agent or browser access. Policy broker/edge. App connector in private network. IdP for auth. PDP decision per app session.
Logs: user, device, app, allow/deny — feeds SIEM literacy.
Command guide
Try these commands — ZTNA components (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: CISA ZTMM Networks (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. ZTNA vs VPN literacy preview
VPN: network layer trust often too broad. ZTNA: app layer, default deny other resources.
Full comparison in M6 L3 — this card names ZTNA parts only.
3. Architecture stub
User → IdP → ZTNA broker → connector → internal app. Label on markdown diagram.
Ship: ZTNA component card + diagram. Next: SASE Named.
4. What you ship: ZTNA architecture card
Broker, connector, IdP, app catalog rows + diagram stub. $ZT_LAB fictional. chmod 600.
5. What you record before the next lesson
Date. ZTNA card. $ZT_LAB named. File t40-m06-l01-ztna-named.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Draw ZTNA as full subnet VPN replacement without app catalog row. Scan stranger ZTNA portal.
Right
Write ZTNA card with per-app access diagram. Next: SASE Named.
Mission: ZTNA architecture card
1) Name four ZTNA components. 2) List three fictional published apps. 3) Draw broker path diagram. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
App catalog is scope control — not every internal IP published.
Knowledge Check
APPLY: ZTNA primarily grants:
Multiple choice
Knowledge Check
APPLY: True or False: ZTNA integrates with IdP for authentication.
True or False
Knowledge Check
APPLY: ZTNA card belongs on:
Multiple choice