A cloud architect is explaining the guiding principle of a zero-trust architecture to stakeholders who are used to a traditional perimeter model. Which statement best expresses the central premise of zero trust?
- ANo user or device is trusted by default regardless of location, and each access request is authenticated and authorised on its own merits. Correct
- BDevices located inside the corporate network are inherently trusted, so internal traffic can move freely once a user is past the perimeter firewall.
- CTrust is granted once at initial login and persists for the whole session, avoiding repeated checks that would slow users down.
- DTrust is established purely by the strength of the network encryption, so a well-encrypted link needs no further identity checks.
Why A is correct: Correct. Zero trust assumes no implicit trust based on network position and verifies every access request explicitly, applying least privilege per request.
Why B is wrong: Tempting because it reflects the older perimeter model, but zero trust explicitly rejects the idea that internal location confers trust.
Why C is wrong: Zero trust favours continuous, per-request evaluation rather than a single durable grant; a one-time check contradicts its core stance.
Why D is wrong: Encryption protects data in transit but does not establish identity or authorisation; zero trust still requires verifying who and what is requesting access.