hardMultiple SelectObjective-mapped
CAS-004 Practice Question: Which THREE of the following are key components…
Which THREE of the following are key components of a zero-trust security architecture? (Select THREE).
⚠ Common exam trap
Many candidates confuse zero-trust with traditional perimeter-based security and select 'VPN concentrator' as a key component, not realizing that zero-trust replaces VPNs with identity-aware, per-application access (e.g., ZTNA) and that implicit trust for internal traffic is explicitly rejected in zero-trust models.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Micro-segmentation
Micro-segmentation is a core component of zero-trust architecture because it divides the network into isolated zones, each requiring separate authentication and authorization for any cross-zone traffic. This enforces the 'never trust, always verify' principle by preventing lateral movement even if an attacker compromises a single segment, unlike traditional flat networks where internal traffic is implicitly trusted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPN concentrator
Why it's wrong here
VPN concentrators are perimeter-based and grant broad network access, contrary to zero trust.
- ✓
Micro-segmentation
Why this is correct
Micro-segmentation divides the network into isolated zones to contain threats.
- ✗
Implicit trust for internal network traffic
Why it's wrong here
Zero trust eliminates implicit trust; all traffic must be verified.
- ✓
Least privilege access control
Why this is correct
Least privilege ensures users and devices have only the minimum access needed.
- ✓
Continuous monitoring of user and device behavior
Why this is correct
Continuous monitoring ensures each access request is validated in real-time.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.