A security analyst is documenting how the organisation's zero trust model treats network location. Which statement best captures the defining principle of zero trust as it applies to that documentation?
- AEvery access request is authenticated and authorised on its own merits, regardless of whether it originates inside or outside the corporate network. Correct
- BTraffic that has already crossed the perimeter firewall is treated as trusted so that internal east-west flows are not slowed by repeated checks.
- CA hardened VPN concentrator is placed at the edge so remote users inherit the same trust level as staff sitting in the office.
- DDevices enrolled in mobile device management are permanently trusted for the life of their certificate without further evaluation.
Why A is correct: This is correct because zero trust removes implicit trust based on network position and evaluates identity, device posture and context per request.
Why B is wrong: This is tempting because it describes the traditional castle-and-moat model, but it is the exact assumption zero trust rejects; internal traffic is not implicitly trusted.
Why C is wrong: This is tempting because VPNs are common, yet granting broad inherited trust after a single tunnel login is the flat-trust model zero trust is designed to replace.
Why D is wrong: This is tempting because device enrolment matters, but permanent trust contradicts the continuous, per-request verification that zero trust requires.