Which statement captures a core principle of Zero Trust architecture?

• A. Zero Trust means once authenticated, access is unrestricted.
• B. Verify explicitly, least privilege, assume breach, microsegmentation, continuous monitoring, and robust authentication/authorization.
• C. Zero Trust requires no access controls.
• D. Zero Trust eliminates the need for encryption.

Answer: (B)

Zero Trust means never trust by default; every access request must be verified. The statement that best reflects this approach lists several interrelated practices: verify explicitly to confirm identities and context for each access, enforce least privilege so users and services have only what they need, assume breach to design defenses that minimize damage, use microsegmentation to limit lateral movement, maintain continuous monitoring to detect and respond to suspicious activity, and require robust authentication and authorization to make strong access decisions. Together these elements embody the disciplined, ongoing verification and restricted access that Zero Trust enforces. The other options contradict this: unrestricted access after authentication, no access controls, or eliminating encryption, none of which align with Zero Trust principles.