A distributed workforce now reaches company applications from home, hotels and client sites. The current design grants broad internal network access once a user connects through the VPN. Which design intent BEST supports the redesign of remote access?
Select an answer to reveal the explanation.
Short Explanation
Zero trust is like a hotel where your key card opens only your room, and it's checked every time you swipe, not just at the front desk. Getting in the lobby shouldn't give you every floor. The trap is anything that trusts you because of where you connected from.
Full Explanation
Zero trust design assumes that network location confers no trust. Each request to a resource is evaluated explicitly using identity, device posture and context, and access is limited to the specific resource and the minimum privilege required. For a workforce spread across homes, hotels and client sites, this replaces the all-or-nothing access granted after a VPN connection with resource-level decisions that remain valid wherever the user is. Trusting devices for a whole session after they join the VPN is exactly the implicit trust the redesign must remove; a compromised device would retain broad access for hours. Extending the perimeter to every remote location tries to recreate the old trusted network at a scale that is costly and impossible to secure consistently, and it keeps the flawed assumption that inside means safe. Granting full network access based on a background check confuses a personnel screening control with access control; screening does not limit what a stolen credential can reach. Exam caveat: CISM tests zero trust as a design intent and set of principles, not as a product, and expects alignment with business access needs. Operational check: for a sample of remote sessions, confirm that access decisions are made per application, reflect device and identity signals, and grant no network-wide reach.