CISSP Communication and Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Trust but verify

  Why it's wrong here

  The "trust but verify" model implies an initial level of trust is granted, followed by verification to confirm that trust is warranted. This fundamentally contradicts the Zero Trust architecture, which operates on the principle that no entity, whether inside or outside the network perimeter, should be inherently trusted. Zero Trust mandates continuous authentication and authorization for every access request, regardless of prior interactions or network location, making "trust but verify" an unsuitable guiding principle.

• ✗

  Rely on perimeter defenses

  Why it's wrong here

  Relying primarily on perimeter defenses is a legacy security model that assumes everything inside the network boundary is trustworthy. Zero Trust explicitly rejects this approach, recognizing that sophisticated threats can bypass traditional perimeters, rendering internal assets vulnerable. Instead, Zero Trust distributes security controls throughout the network, treating every access attempt as if it originates from an untrusted environment, thereby minimizing the impact of a perimeter breach.

• ✓

  Never trust, always verify

  Why this is correct

  "Never trust, always verify" is the foundational tenet of Zero Trust, asserting that no user, device, or application should be implicitly trusted, regardless of its location or previous authentication status. Every access request must be authenticated, authorized, and continuously validated based on context, such as user identity, device posture, and requested resource. This principle enforces a strict "assume breach" mentality, requiring granular access controls and continuous monitoring to minimize the attack surface and contain potential threats effectively.

• ✗

  Trust internal traffic implicitly

  Why it's wrong here

  Implicitly trusting internal network traffic is a critical vulnerability in traditional security models, as it allows attackers who breach the perimeter to move laterally unhindered within the network. Zero Trust directly counters this by applying the same stringent authentication and authorization policies to internal traffic as it does to external traffic. This approach, often implemented through micro-segmentation, ensures that even internal communications are continuously verified, preventing unauthorized lateral movement and significantly reducing the blast radius of a successful compromise.

Go deeper

Related to this question