A company is replacing a model in which anything on the internal network was trusted with one where every access request is evaluated on its own merits. Which statement captures the core principle of the new model?
Select an answer to reveal the explanation.
Short Explanation
In the old castle-and-moat model, once you crossed the drawbridge you could wander anywhere. Zero trust checks your badge at every door, no matter where you're standing. The trap is any answer where location or a past login buys you a free pass.
Full Explanation
Zero trust removes implicit trust based on network location. Under the traditional perimeter model, anything inside the firewall was treated as trustworthy, which let attackers who breached one system move laterally with little resistance. In a zero trust architecture, every request to a resource is authenticated and authorized using identity, device posture, and context, and access is granted with least privilege, per session, whether the user sits in headquarters, a branch, or a hotel. NIST SP 800-207 frames this as protecting resources rather than network segments. Trusting traffic once it passes the perimeter firewall is precisely the perimeter assumption that zero trust abandons. Trusting LAN users by default while requiring VPN only for remote users still ties trust to location, and a VPN connection itself does not establish per-request trust. Exempting devices from later checks after one successful login contradicts continuous verification, since posture and behavior can change after authentication. Exam caveat: zero trust does not mean eliminating firewalls or VPNs; existing controls can serve as enforcement points within the new model. Operational check: pick one internal application, confirm access requires authentication and authorization even from the corporate LAN, and verify that device posture is evaluated before access is granted.