A vendor tells leadership that buying its single appliance will deliver zero trust for the company. The CISO disagrees. Which statement best supports the CISO's view?
Select an answer to reveal the explanation.
Short Explanation
You can't buy a healthy lifestyle in one box from the store, and you can't buy zero trust that way either. It's an architecture — identity, devices, workloads, and networks working together. The trap is any answer that turns it into one product, one protocol, or one certificate.
Full Explanation
Zero trust is a security strategy and architecture, not a product category. NIST SP 800-207 describes it as a set of principles and logical components, including policy decision and enforcement points, identity, device posture, data protection, and continuous monitoring, that organizations implement by integrating many controls. Cisco frames its approach around securing the workforce, workloads, and the workplace, combining capabilities such as multifactor authentication, device trust, microsegmentation, and network access control. A single appliance can serve as one enforcement point, but it cannot verify identities, assess endpoint health, segment workloads, and monitor behavior across the whole environment by itself. Zero trust is not a certification earned by appliances; there is no standards body audit that makes a device zero trust. It is not limited to remote users, since internal access is evaluated in the same way, and on-premises enforcement points contribute directly. It is not a protocol and does not replace TLS, which remains a component for protecting data in transit. Exam caveat: maturity models describe zero trust adoption as gradual, moving pillar by pillar rather than in a single purchase. Operational check: map current controls against identity, device, network, application, and data pillars, identify gaps, and plan phased improvements rather than a single procurement.