Zero trust

Zero trust is the architectural principle of never trust, always verify: no request earns access because of where it comes from. Being on the corporate LAN, behind the VPN, or inside the data centre confers nothing; every access is authenticated, authorised against policy, and encrypted, whether it originates in the office or a coffee shop. Identity becomes the perimeter, enforced with multi-factor authentication and least privilege, while network segmentation shrinks each zone of implicit reachability to almost nothing.

The distinction the exam tests is against the traditional perimeter model, the castle and moat: hard shell, soft interior. In that model a device that passes the boundary is trusted by default, which is exactly what lateral movement exploits. Zero trust replaces the one-time gate with continuous verification: sessions are re-evaluated as device posture, location, and behaviour change, and micro-segmentation keeps a compromised host from reaching anything it was not explicitly granted.

Exam relevance: if a scenario mentions implicit trust based on network location, or an attacker moving freely once inside the perimeter, the answer is zero trust. Continuous verification, micro-segmentation, and identity as the perimeter all point the same way. Contrast defense in depth, which layers controls but can still trust the interior; zero trust removes that interior trust, and the two are complementary rather than rivals.