What security paradigm is described by the phrase 'Never trust, always verify' and emphasizes identity validation and microsegmentation?

• A. Zero Trust Architecture
• B. Perimeter Defense
• C. Trust but Verify
• D. Defense in Depth

Answer: (A)

The principle being tested is Zero Trust Architecture. It rejects the idea that any traffic—whether it originates inside or outside the network—can be trusted by default and instead requires continuous verification of every access request.

In Zero Trust, identity validation is central. Each user, device, and session must be authenticated and authorized for the specific action or resource they’re trying to access, often with context like device posture, location, and time. Verification is ongoing, not a one-time check at the perimeter.

Microsegmentation is a key technique within Zero Trust. By dividing the network and workloads into tiny, tightly controlled segments, even legitimate credentials can’t freely move laterally. Access is granted only to the exact resources needed, following least-privilege principles, which limits potential damage if a credential is compromised.

The other options don’t capture this combination. Perimeter Defense emphasizes a strong outer boundary and often assumes trust once past it, which conflicts with never-trust, always-verify. Defense in Depth is a broad, layered approach but doesn’t inherently focus on continuous verification of every access or microsegmented isolation. Trust but Verify is a general phrase rather than a formal paradigm with the same precise emphasis on identity-first verification and microsegmentation.