In zero trust security, which principle governs access requests?

• A. Provide broad trust based on location
• B. Allow access without verification for internal users
• C. Every access request must be verified regardless of network location
• D. Verification is optional after initial login

Answer: (C)

In zero trust, nothing is trusted by location or origin—every access request is treated as untrusted until it’s verified and authorized. This principle means that every attempt to reach a resource must be authenticated, authorized, and continually validated, no matter where the request comes from. So the best answer is that every access request must be verified regardless of network location, incorporating checks like identity, device health, and context to enforce least privilege.

Why the other ideas don’t fit: granting broad trust based on being inside the network ignores who is requesting access and their current risk, which defeats zero trust. allowing access without verification for internal users directly contradicts the requirement to verify every request. making verification optional after initial login misses ongoing risk assessment and dynamic policy evaluation that zero trust relies on.