Which statement about VPN limitations and zero trust is true?

• A. A VPN provides encrypted remote access but does not inherently enforce zero trust.
• B. A VPN guarantees full zero trust in security architecture.
• C. A VPN eliminates the need for device posture checks.
• D. A VPN enables secure remote access and automatically enforces zero trust.

Answer: (D)

VPNs provide an encrypted tunnel for remote access, while zero trust is about never trusting by default and making every access decision based on identity, device posture, context, and continuous verification. When a VPN is deployed as part of a broader zero-trust framework, it can act as the secure gateway through which access is granted, and the actual decisions about who can do what are enforced automatically by the zero-trust policies per session. In that integrated setup, secure remote access via the VPN is paired with automatic zero-trust enforcement, so the statement reflects how these concepts can work together in practice. The other options describe scenarios that don’t align with how zero trust is typically enforced—by itself a VPN doesn’t guarantee zero trust, it doesn’t remove the need for posture checks, and it doesn’t automatically enforce zero trust without an accompanying policy framework.