easyMultiple SelectObjective-mapped
CAS-004 Practice Question: A security architect is designing a zero-trust…
A security architect is designing a zero-trust network architecture for a hybrid cloud environment. Which TWO principles should be implemented to enforce the "never trust, always verify" model?
⚠ Common exam trap
The CAS-004 exam often tests the misconception that zero trust relies on network segmentation alone, but the trap here is that candidates confuse micro-segmentation (a valid enforcement mechanism) with implicit trust for internal IPs or VPNs, which are antithetical to the zero-trust model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Micro-segmentation between workloads
Micro-segmentation (A) is correct because it divides the network into isolated segments at the workload level, enforcing granular security policies that restrict lateral movement. This aligns with the zero-trust principle of 'never trust, always verify' by requiring explicit permission for every inter-workload communication, regardless of network location.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Micro-segmentation between workloads
Why this is correct
Micro-segmentation enforces least privilege.
- ✗
Trust based on network location
Why it's wrong here
Trusting based on network location violates the zero-trust principle of eliminating implicit trust from network position, as a hybrid cloud environment requires continuous verification of every request regardless of whether it originates from an internal corporate subnet or a public cloud VPC. This option is tempting because network location is a traditional perimeter security control that effectively restricts lateral movement in a purely on-premises environment, where it would be a correct choice for segmenting traffic between trusted internal zones and untrusted external networks.
- ✗
Implicit trust for internal IP ranges
Why it's wrong here
Implicit trust contradicts zero-trust.
- ✓
Continuous authentication and authorization for every request
Why this is correct
Continuous verification is a zero-trust requirement.
- ✗
Use of a single VPN for all remote access
Why it's wrong here
A VPN is a tool, not a zero-trust principle.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.