A remote employee connects to the corporate VPN but is still prompted to authenticate and pass a device-health check before each internal application opens. The employee asks why being on the VPN is not enough. Which principle explains this behavior?
Select an answer to reveal the explanation.
Short Explanation
In the old model, getting through the front gate meant you could wander anywhere inside. Zero Trust says, "Nice that you're on the VPN, now prove it again for this app." Don't fall for the idea that being inside the network earns you anything.
Full Explanation
Zero Trust removes implicit trust based on where a request comes from. Being connected to the VPN places the device on a trusted network in a perimeter model, but a Zero Trust design evaluates each access request on its own merits, considering user identity, authentication strength, device health, and context before granting a session to a specific resource. The repeated prompts and posture checks are that per-request verification in action. Defense in depth describes layering diverse controls; it does not require the VPN concentrator to re-authenticate the user for each application, and the behavior described comes from per-resource policy, not from the concentrator. Least privilege limits the rights granted to the minimum required; it would scope what the user can reach but would not by itself force fresh verification at each application, and it does not mean the tunnel carries one application at a time. Separation of duties divides critical tasks among people to prevent fraud; it is about splitting responsibilities, not about issuing a distinct credential for every application. Exam caveat: phrases like never trust, always verify and no implicit trust zones signal Zero Trust even when a VPN is present. Operational check: review the access policy for an internal application and confirm it evaluates user identity, MFA, and device compliance on every new session, regardless of the source network.