What is zero-trust security and its core principle?

• A. Provide blanket access to assets after login
• B. Trust all users from corporate network
• C. Never trust by default; require continuous verification, least-privilege access, and micro-segmentation for every access request
• D. Use only perimeter-based security

Answer: (C)

Zero-trust security assumes no one is trustworthy by default, whether inside or outside the network. For every access request, identity must be verified, authorization checked with the principle of least privilege, and communications kept encrypted. It also uses micro-segmentation to limit lateral movement, so compromising one part of the system doesn’t grant broad access. This contrasts with blanket access after login, trusting all users on the corporate network, or relying solely on perimeter-based defenses.