A county moves from trusting the internal LAN by default to verifying every access request. Which principle best describes that shift?
Select an answer to reveal the explanation.
Short Explanation
Old castle thinking said 'inside the moat equals safe.' Zero trust says 'show your badge every door, every time' — even on the so-called inside. It is continuous verification, not 'throw away the VPN and hope.'
Full Explanation
Zero trust reduces implicit trust based on network location and instead continuously verifies identity, device posture, context, and policy before granting or continuing access. A county that moves from "trust the internal LAN by default" to verifying every access request is adopting that principle: being on a municipal subnet is no longer sufficient proof of trustworthiness.
Air gapping every workstation so no county network remains is not the definition of zero trust; extreme isolation may be used in niche high-impact environments but is not what the principle requires and can break legitimate civic operations. Removing all encryption so inspection can occur in cleartext contradicts security fundamentals and is not a zero-trust mandate—inspection can use TLS interception or endpoint controls without abolishing encryption everywhere. Granting standing admin rights on every subnet to simplify support increases implicit trust and blast radius, which is the opposite of zero trust's least-privilege, continuously verified access model.
Exam caveat: SY0-701 frames zero trust around never trust by default and always verify, including control-plane versus data-plane ideas. Avoid vendor-only slogans and avoid equating zero trust with "no remote access" or "no internal network."
Operational check: redesign county access so VPN or campus presence alone does not unlock sensitive apps; require strong identity, device compliance checks where feasible, just-in-time privileges, microsegmentation or application-level gateways, and continuous monitoring that can revoke access when risk signals change.