A school district wants zero trust because the term appears in industry blueprints, and a board member asks which Enterprise Security dashboard to open for it. What is the accurate framing?
Select an answer to reveal the explanation.
Short Explanation
Zero trust is how you hand out keys — verify, least privilege — not a tile on the ES home screen. The SOC watches the logs those access decisions leave behind. There is no Zero Trust dashboard, CIM model, or disposition with that brand.
Full Explanation
When a school district wants "zero trust" because the term appears in industry blueprints, the accurate framing is that zero trust is an access-architecture idea of verify explicitly and least privilege that Enterprise Security can monitor in logs—not an ES dashboard brand. Civic boards often confuse marketing vocabulary with product tiles; the SOC must separate architecture principles from SIEM UI. ES watches the telemetry those access decisions leave behind.
Claiming Zero Trust is the name of a built-in ES dashboard that replaces Adaptive Response fails by concept: there is no such brand dashboard that replaces Adaptive Response. Claiming Zero Trust is a CIM data model that must be accelerated before triage fails by concept: zero trust is not a CIM model. Claiming Zero Trust is a notable disposition used instead of False Positive fails by concept: dispositions are investigation outcomes, not architecture brands.
Exam caveat: Zero trust = architecture/principle; ES may monitor related signals—do not invent Zero Trust dashboards, CIM models, or dispositions.
Operational check: Brief the board that zero-trust outcomes are enforced in identity and network controls, then show which ES detections and data sources monitor verify-and-least-privilege failures—without pointing at a nonexistent Zero Trust home tile.