A network architect is implementing a zero-trust architecture. Which statement best describes the core principle of zero trust regarding network location?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — zero trust doesn't care whether you're inside or outside the perimeter. You must authenticate, get authorized, and keep proving it for every request. The idea that internal users are automatically trusted is exactly what zero trust rejects.
Full Explanation
The correct statement is the one saying network location, inside or outside the perimeter, is not inherently trusted and every access request must be authenticated, authorized, and continuously validated. Zero trust abandons the trusted internal network zone; every user, device, and service must authenticate and be authorized before accessing any resource regardless of physical or network location. The statement that internal network users are trusted and external users must authenticate is wrong because zero trust rejects the trusted internal/untrusted external distinction; all requestors are potentially untrusted. The TLS 1.3 encryption statement is wrong because encryption matters but is not the defining principle; continuous identity verification is. The statement replacing all firewalls with identity-aware proxies is wrong because zero trust can include firewalls alongside identity-aware proxies and does not mandate replacing all firewalls.