The city is adopting zero trust so a finance clerk on the "inside" VLAN is still challenged and granted only the access needed for the job. What does that design actually mean?
Select an answer to reveal the explanation.
Short Explanation
Zero trust is not "take the city wall down." It is the bouncer who still checks ID in the employee lounge — inside VLAN or not, prove it and get only the keys you need. Killing the firewall or handing out domain admin is the opposite idea.
Full Explanation
The city is adopting zero trust so a finance clerk on the "inside" VLAN is still challenged and granted only the access needed for the job. That design means continuous verification and least privilege even for users already on the internal VLAN. Civic framing matters because municipal networks often treat internal VLANs as trusted by default; zero trust rejects that assumption for finance and other high-value civic roles.
Turning off the perimeter firewall because inside traffic is trusted fails by concept: zero trust does not remove perimeter controls or declare inside traffic inherently safe—it adds continuous checks. Replacing Enterprise Security notables with a single VPN concentrator fails by concept: VPN remote access is not a substitute for detection, correlation, or least-privilege authorization inside the city. Granting domain admin to anyone who authenticates on the inside VLAN fails by concept: that expands privilege after a single auth event, which is the opposite of least privilege and continuous verification.
Exam caveat: SPLK-5001 expects zero trust to mean verify continuously and grant least privilege regardless of network location—do not equate it with removing firewalls, collapsing ES into VPN, or trusting the inside VLAN.
Operational check: Review finance-clerk access policies for step-up authentication and role-scoped entitlements on the internal VLAN, confirm perimeter and ES monitoring remain in place, and reject any design note that equates "inside" with unlimited civic privilege.