mediumMultiple Choice
CAS-004 Practice Question: A security architect is designing a zero-trust…
A security architect is designing a zero-trust network architecture. Which of the following is a fundamental principle of zero trust?
⚠ Common exam trap
Candidates often mistakenly believe that network segmentation (VLANs) or VPNs achieve zero trust, but zero trust requires per-session authentication, authorization, and encryption for every access regardless of network location.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authenticate and authorize every device and user for every resource access, and encrypt all communication.
Zero trust is built on the principle of 'never trust, always verify.' This means every device and user must be authenticated and authorized for each resource access, regardless of network location, and all communication should be encrypted to protect data in transit. This eliminates implicit trust based on network perimeter and enforces least-privilege access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all resources on the internal network and rely on perimeter firewalls.
Why it's wrong here
Perimeter firewalls assume everything inside the network is trusted, the exact model zero trust replaces with verify-explicitly and assume-breach. This castle-and-moat design is still valid for isolated legacy enclaves with no external identity integration, but it cannot enforce per-session authorisation.
- ✓
Authenticate and authorize every device and user for every resource access, and encrypt all communication.
Why this is correct
Authenticating and authorising every device and user per resource access satisfies zero trust's verify-explicitly principle, replacing implicit trust from network location. Continuous per-request evaluation, combined with encryption of all communication, enforces least-privilege access and assumes breach, directly meeting the scenario's requirement for a fundamental zero-trust principle.
- ✗
Implement VLANs to separate traffic based on user roles.
Why it's wrong here
VLANs segment east-west traffic by role but still grant implicit trust once a host is on the segment, contradicting zero trust's per-request verification. Segmentation is genuinely useful for limiting lateral movement in flat legacy networks, which is why it tempts architects, yet it never evaluates identity or device posture per session.
- ✗
Use a VPN to secure all remote access to the corporate network.
Why it's wrong here
A VPN authenticates the user once, then places them inside the trusted network, so access is not evaluated per request as zero trust demands. VPNs remain the right tool for securing legacy remote connectivity to on-premises resources that cannot be exposed through a broker.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.