What is Zero Trust architecture and its core principle?

• A. Perimeter security alone is sufficient.
• B. Always trust users unless compromised.
• C. Trust inside perimeter but verify at access.
• D. Never trust, always verify; continuous authentication/authorization and least privilege with micro-segmentation.

Answer: (D)

Zero Trust is a security approach built on the idea that you should never automatically trust anything inside or outside your network. Instead, every access request is treated as untrusted and must be verified continuously. This means authentication and authorization are required for each action, and the system uses context—who is requesting, the device health, location, time, and the sensitivity of the resource—to decide whether to grant access. Access is restricted to the minimum needed (least privilege) and often enforced with micro-segmentation, so even if a breach occurs, movement within the network is limited. This ongoing verification, plus strict least-privilege policies, is what sets Zero Trust apart from traditional perimeter-based security.

The other options describe less secure or outdated ideas. Relying on a perimeter alone assumes trust once inside, which is risky. Trusting users by default is the opposite of Zero Trust. And trusting inside the perimeter but only verifying at the edge misses the continuous, context-aware verification that Zero Trust relies on.