A department claims that deploying a VPN is enough to achieve Zero Trust for all municipal cloud apps. Why is that claim incomplete?
Select an answer to reveal the explanation.
Short Explanation
A VPN is a tunnel, not a complete Zero Trust program. Once someone is "inside," perimeter thinking often stops checking—Zero Trust keeps verifying. Location on a private link is only one signal, not the whole strategy.
Full Explanation
A VPN can encrypt traffic and place remote users onto a private path, but by itself it reflects classic perimeter thinking: once connected, the network is often treated as trusted. Zero Trust still requires explicit verification of identity and device, least-privilege authorization to apps and resources, and the assumption that compromise can occur even on “trusted” networks. Therefore deploying a VPN for municipal cloud apps is incomplete as a Zero Trust claim; it may be one useful network control, but it does not replace continuous identity-driven checks or scoped permissions.
A VPN does not automatically enable every Microsoft Defender plan without configuration. It does not replace Microsoft Entra ID or remove the need for user authentication. It also does not convert public endpoints into Azure Policy initiatives—Policy is a governance service, separate from VPN connectivity.
Exam caveat: AZ-900 frequently contrasts perimeter trust with Zero Trust; any answer that treats network location alone as sufficient verification is incomplete.
Operational check: after VPN deployment, confirm users still authenticate to apps with Entra ID, that Conditional Access or MFA applies as required, and that RBAC roles remain least privilege—documenting that VPN is complementary, not a Zero Trust substitute.