What is zero-trust architecture and what are its core components relevant to operations?

• A. A security model that trusts internal network; core components: static access controls
• B. A security model requiring verification for every access request. Core components: strong authentication, continuous authorization, device posture checks, micro-segmentation, and least-privilege access
• C. A model focusing on perimeter firewall only
• D. An architecture for offline systems

Answer: (B)

Zero-trust architecture treats every access request as untrusted until proven otherwise, requiring verification for every access attempt regardless of location. In operations this means enforcing policies that continuously validate who is requesting access, what they’re trying to reach, and the state of the device and context at the moment of access.

The core components that enable this are strong authentication (often multi-factor), continuous authorization that re-evaluates permissions as context changes, device posture checks to ensure the requesting device is compliant and healthy, micro-segmentation to limit lateral movement by enforcing granular network segments, and least-privilege access to ensure users and services have only the minimal rights needed. Together, these elements support dynamic, policy-based control rather than relying on a trusted internal network perimeter.

Choosing options that rely on trusting internal networks with static controls, focusing only on a perimeter firewall, or addressing offline systems misses the ongoing verification, contextual decisions, and granular enforcement that zero-trust requires.