Cloud Digital Leader Trust and security with Google Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Zero Trust assumes that internal network traffic is more secure than external traffic because it has passed through the corporate firewall

  Why it's wrong here

  This describes the traditional perimeter-based model that Zero Trust explicitly dismantles. Assuming the corporate firewall creates a trusted inside is dangerous because attackers who breach one host can move laterally, and compromised devices or rogue employees already operate from inside the perimeter. Zero Trust treats every network—internal or external—as hostile and enforces per-request verification based on identity, device health, and context, not source IP or firewall traversal.

• ✓

  Zero Trust assumes no traffic is trusted by default regardless of network origin — every request must be explicitly authenticated and authorized based on identity, device posture, and context

  Why this is correct

  This is the core Zero Trust principle: 'never trust, always verify.' A request from inside the VPC receives the same verification scrutiny as a request from the public internet. This model is more appropriate for cloud environments where the network perimeter no longer has clear meaning — employees, services, and attackers can all be inside the 'perimeter.'

• ✗

  Zero Trust assumes all traffic is malicious and blocks all requests by default, requiring explicit allowlisting for each connection

  Why it's wrong here

  Zero Trust doesn't block all traffic — it requires all traffic to be verified. 'Never trust, always verify' means authentication and authorization for every request, not blocking everything. Legitimate users and services can access what they need once verified.

• ✗

  Zero Trust eliminates the need for encryption since all traffic is assumed to be on secure internal networks

  Why it's wrong here

  Zero Trust actually mandates encryption rather than removing it. Since no network segment—including the corporate LAN or VPC—is considered inherently trustworthy, all traffic is presumed susceptible to eavesdropping and must be protected with TLS, IPSec, or similar mechanisms. Authentication and authorization verify the identity and posture of a request, but they do not protect the payload in transit; encryption ensures confidentiality and integrity regardless of network placement.

Go deeper

Related to this question