Cloud Digital Leader Trust and security with Google Cloud Practice Question
A security architect wants to implement a 'never trust, always verify' security approach where no user or service is assumed to be trustworthy based on network location alone. Every access request must be authenticated and authorized regardless of whether it comes from inside or outside the corporate network. Which security model describes this approach?
⚠ Common exam trap
Many exam-takers confuse 'defense in depth' (Option C) with Zero Trust because both involve multiple security layers, but defense in depth does not inherently require every request to be verified regardless of network location, which is the defining characteristic of Zero Trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Zero Trust security model
The Zero Trust security model (Option B) is correct because it explicitly enforces the 'never trust, always verify' principle, requiring authentication and authorization for every access request regardless of network location. In Google Cloud, this aligns with BeyondCorp, which uses identity-aware proxy (IAP) and context-aware access to verify each request based on user identity, device posture, and other attributes, rather than trusting based on IP address or network perimeter.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perimeter security model
Why it's wrong here
The perimeter security model, often called the castle-and-moat approach, assumes that anything inside the network firewall is inherently trustworthy and only focuses protections on the network edge. This model fails against insider threats, compromised credentials, and advanced attackers who breach the perimeter and then move laterally with minimal friction, because it never re-evaluates trust for internal requests, directly contradicting Zero Trust's continuous verification.
- ✓
Zero Trust security model
Why this is correct
The Zero Trust security model fundamentally eliminates implicit trust based on network location, mandating continuous authentication, authorization, and encryption for every request, regardless of whether the source is inside or outside the corporate boundary. It operationalizes the 'never trust, always verify' principle through identity-centric policies, device posture checks, and microsegmentation, ensuring that even compromised internal hosts cannot move laterally without re-verification.
- ✗
Defense in depth model
Why it's wrong here
Defense in depth is a risk-management strategy that layers independent security controls—such as firewalls, intrusion detection, antivirus, and endpoint protection—so that if one fails, others provide redundancy. While complementary to Zero Trust, it describes the stacking of countermeasures rather than a policy of verifying each request's legitimacy based on identity and context; a defense-in-depth architecture can still trust internal traffic implicitly, unlike Zero Trust.
- ✗
Principle of least privilege
Why it's wrong here
The principle of least privilege is an access-control practice that grants users and services only the minimum permissions required to perform their functions, reducing the blast radius of compromised accounts. However, it is a single component of a comprehensive security strategy, not an architectural model; it does not inherently require dynamic re-authentication of every request, ongoing device health assessment, or encryption of all traffic, which are hallmarks of Zero Trust.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Network perimeter
A network perimeter is the boundary between an organization's internal trusted network and external untrusted networks like the internet, where security controls are deployed to protect internal assets.
Key term
Security model
A security model is a formal framework that defines how subjects (users, processes) can access objects (files, resources) based on rules, ensuring confidentiality, integrity, and availability.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.