In a zero trust deployment, an employee who signed in at 8:00 a.m. tries at 2:00 p.m. to download a large, highly sensitive dataset from an unfamiliar location. The policy engine evaluates the request and requires the employee to complete MFA again before access is granted. Which zero trust practice does this BEST demonstrate?

Zero trust architecture treats every access request as untrusted until it is evaluated against current context. User authentication is not a one-time event at sign-in; the policy decision point continuously assesses signals such as location, behavior, resource sensitivity, and time, and it can demand step-up authentication when risk rises. Requiring MFA again for an unusual, high-sensitivity request hours after the initial sign-in is continuous, risk-based authentication in action. Implicit trust based on network location is precisely what zero trust rejects; being on a corporate network does not entitle a user to access, and the scenario's unfamiliar location makes such trust even less appropriate. Treating the morning sign-in as valid until it expires reflects a traditional session model in which a successful login authorizes all later actions, which is the opposite of what the policy engine did. Device inventory checks at hardware issuance are part of device management, but they confirm a device is known, they do not reevaluate the user's identity at the moment of a risky request, and a check performed only once does not reflect current conditions. Exam caveat: continuous evaluation should be risk-proportionate, because prompting for every low-risk request causes fatigue and pushes users toward workarounds. Operational check: review the conditional access policies that trigger step-up authentication and confirm high-sensitivity resources require fresh verification.