Define zero trust security and its core principle.

Define zero trust security and its core principle.

• A. A model that trusts internal network by default.
• B. A security model that requires verification for every access attempt, regardless of network location, assuming the network is compromised.
• C. A model that prohibits external access entirely.
• D. A model that only verifies users once on login.

Answer: (B)

Zero trust security is a model that never blindly trusts, even for requests that originate inside the network. Every access attempt must be authenticated and authorized, and evaluated in context—who the user is, what device they’re on, its health, where they’re connecting from, and what resource they’re trying to reach. The core idea is to assume the network could be compromised, so trust is never granted by location or network perimeter alone. Access is granted only after continuous verification and under least-privilege policies, often supported by MFA, device posture checks, micro-segmentation, and dynamic, policy-driven decisions that can adapt in real time. This aligns with the notion of requiring verification for every access attempt, regardless of network location, and operating under the assumption that the network is compromised. The other alternatives miss the essential stance: trusting internal networks by default, completely prohibiting external access, or verifying only once at login all misalign with continuous, context-aware validation and least-privilege access.

Zero trust security is a model that never blindly trusts, even for requests that originate inside the network. Every access attempt must be authenticated and authorized, and evaluated in context—who the user is, what device they’re on, its health, where they’re connecting from, and what resource they’re trying to reach. The core idea is to assume the network could be compromised, so trust is never granted by location or network perimeter alone. Access is granted only after continuous verification and under least-privilege policies, often supported by MFA, device posture checks, micro-segmentation, and dynamic, policy-driven decisions that can adapt in real time.

This aligns with the notion of requiring verification for every access attempt, regardless of network location, and operating under the assumption that the network is compromised. The other alternatives miss the essential stance: trusting internal networks by default, completely prohibiting external access, or verifying only once at login all misalign with continuous, context-aware validation and least-privilege access.