What best describes zero-trust security?

• A. A security model that requires verification for every request, regardless of origin; no implicit trust inside or outside perimeter.
• B. Assumes all internal traffic is trusted and never verified.
• C. Relies on a strong perimeter defense only.
• D. A security model that depends on a single sign-on token for all users.

Answer: (D)

Zero-trust security treats all access attempts as untrusted until proven otherwise. In practice, every request to access a resource must be authenticated and authorized, regardless of where it comes from—inside or outside the network. Access is granted only to the minimum privileges needed, and continuous verification and monitoring are part of the model. This approach removes any implicit trust based on location and relies on strict verification for each interaction.

That description aligns with the idea that there is no inherent trust inside or outside the perimeter; only verified, least-privilege access is allowed. The other notions don’t fit zero-trust: assuming internal traffic is trusted contradicts the model, relying solely on a strong perimeter defense treats the boundary as trustworthy, which zero-trust rejects, and relying on a single sign-on token alone misses the ongoing verification and fine-grained access controls central to zero-trust.