A municipal architecture board decides that no network location is trusted by default and that every request to cloud resources must be verified continuously. Which security approach are they adopting?
Select an answer to reveal the explanation.
Short Explanation
Sitting on the city hall LAN is not a free VIP pass anymore—every request still has to prove who it is and whether it should proceed. That continuous verify-everything mindset is Zero Trust. Old 'inside equals trusted' habits are exactly what this approach retires.
Full Explanation
Zero Trust principles assume no network location is inherently trusted and require continuous verification of identity and context for requests to resources. When a municipal architecture board decides every request to cloud resources must be verified continuously rather than trusted by LAN or VPN placement alone, they are adopting Zero Trust. That approach better fits modern civic remote work and cloud edges.
Flat trust for any device that once connected to the civic VPN is historical perimeter thinking. Implicit trust for all traffic from the city hall LAN address range trusts topology over identity. Perimeter-only defense that never rechecks identity after the first firewall allow contradicts continuous verification.
Exam caveat: Zero Trust is a strategy (verify explicitly, least privilege, assume breach), not a single product. MFA, device posture, microsegmentation, and identity-aware proxies are common enablers.
Operational check: inventory apps still granting broad access by source IP alone, require SSO+MFA and device checks for admin paths, segment east-west municipal workloads, and pilot continuous access evaluation on a citizen-services app. Track progress in the architecture board’s Zero Trust roadmap.