Which term best describes a security model that requires continuous verification of identity and least-privilege access?

• A. Zero Trust Architecture
• B. VPN-based Access Control
• C. Perimeter Security
• D. Password Policy

Answer: (A)

Zero Trust Architecture relies on continuous verification of identity and least-privilege access. In this model, no user or device is trusted by default, even if they’re inside the network. Every request for access is authenticated and authorized in context—considering identity, device posture, risk signals, and the specific resource being requested—before granting the minimum level of access required. Access is dynamically re-evaluated as conditions change, and micro-segmentation helps limit lateral movement by isolating resources.

This contrasts with VPN-based access control, which often grants broad network access after an initial login, potentially exposing multiple systems once inside. Perimeter security focuses on protecting the outer boundary rather than enforcing strict, ongoing identity and scope checks within the network. A password policy, while important for credential strength, does not define this access model or the continuous verification approach.