A label printer sits on the same user VLAN as the payroll PCs at city hall. The printer must not reach payroll merely because it shares that VLAN, and each request has to be checked. Which approach is that?
Select an answer to reveal the explanation.
Short Explanation
Sharing a hallway with the payroll office should not hand the printer a key to the filing cabinet. You apply zero trust so each request is checked, and sitting on the user VLAN is not itself permission. Trusting everything inside the VLAN, separating other guests while this printer stays trusted, or drawing the wide-area layout does not check that request.
Full Explanation
Zero trust treats location as insufficient proof. Each request is checked, so a printer that shares the user VLAN with payroll is not allowed to reach payroll just because it is in the same broadcast domain. The perimeter model is the tempting twin. It trusts a device once the device is inside the VLAN, which is the assumption the stem rejects. VLAN segmentation can keep guests off the user VLAN. It does not, by itself, stop a printer that is already on the payroll VLAN. Hub-and-spoke describes how sites connect. It does not check a request from the printer to payroll. Exam caveat: zero trust does not mean the printer has no path at all. A path is granted only for the requests policy allows. Operational check: from the printer's address, attempt a payroll connection and confirm it is denied and logged, then confirm a payroll PC with an allowed identity still reaches the service. Record the reading before the change and the reading after it so the next shift can see the symptom actually moved.