mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security architect is designing a zero-trust…
A security architect is designing a zero-trust network architecture. Which of the following is a fundamental principle of zero trust?
⚠ Common exam trap
Candidates often mistakenly believe that network segmentation (VLANs) or VPNs achieve zero trust, but zero trust requires per-session authentication, authorization, and encryption for every access regardless of network location.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authenticate and authorize every device and user for every resource access, and encrypt all communication.
Zero trust is built on the principle of 'never trust, always verify.' This means every device and user must be authenticated and authorized for each resource access, regardless of network location, and all communication should be encrypted to protect data in transit. This eliminates implicit trust based on network perimeter and enforces least-privilege access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all resources on the internal network and rely on perimeter firewalls.
Why it's wrong here
Zero trust eliminates the concept of a trusted internal network; perimeter firewalls are not sufficient.
- ✓
Authenticate and authorize every device and user for every resource access, and encrypt all communication.
Why this is correct
This is the core of zero trust: never trust, always verify, and ensure encrypted communication.
- ✗
Implement VLANs to separate traffic based on user roles.
Why it's wrong here
VLANs are a form of network segmentation but do not enforce per-access authentication and encryption, which are key to zero trust.
- ✗
Use a VPN to secure all remote access to the corporate network.
Why it's wrong here
VPNs provide tunnel encryption but still grant network-level access; zero trust requires per-application access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.