What is zero trust?

• A. Perimeter-based security
• B. Encrypted data in transit
• C. Strict authentication for every access
• D. Never trust, always verify

Answer: (D)

Zero trust is a security approach that assumes you shouldn’t trust any user or device by default, whether inside or outside the network. Access to resources is granted only after strict verification of identity and ongoing authorization, using context such as who the user is, what device they’re on, where they’re located, and current risk. Policies are dynamic and resources are protected through practices like least privilege and continuous monitoring, with verification happening at every access attempt.

That idea fits best with “never trust, always verify” because it captures the core mindset: no implicit trust based on location or network, and constant recheck of credentials and permissions before allowing access. Perimeter-based security, by contrast, relies on a strong boundary rather than treating internal actors as untrusted. Encrypting data in transit is important for protecting data, but it doesn’t define who gets to access which resources or how access is continuously controlled. Strict authentication for every access is part of the picture, but zero trust goes beyond just authentication to include ongoing authorization, context-aware decisions, and continuous verification.