Which concept is a key principle of zero-trust architecture?

Which concept is a key principle of zero-trust architecture?

• A. Identity-based access.
• B. Annual compliance reviews.
• C. Static access controls.
• D. Perimeter-based trust.

Answer: (A)

In zero-trust architecture, access decisions are based on identity rather than network position. Identity-based access means every request is tied to a verified user or service identity, with permissions granted according to their role and the principle of least privilege. The system also continuously evaluates context—device health, authentication strength, location, time, and behavior—to adjust access in real time. This approach removes implicit trust from inside the network and ensures that only the right identities, with the right permissions, can reach the specific resources they need. Annual compliance reviews are periodic checks that don’t drive ongoing access decisions. Static access controls stay fixed and don’t adapt to changing risk or context. Perimeter-based trust assumes the inside is safe, which contradicts zero-trust principles.

In zero-trust architecture, access decisions are based on identity rather than network position. Identity-based access means every request is tied to a verified user or service identity, with permissions granted according to their role and the principle of least privilege. The system also continuously evaluates context—device health, authentication strength, location, time, and behavior—to adjust access in real time. This approach removes implicit trust from inside the network and ensures that only the right identities, with the right permissions, can reach the specific resources they need.

Annual compliance reviews are periodic checks that don’t drive ongoing access decisions. Static access controls stay fixed and don’t adapt to changing risk or context. Perimeter-based trust assumes the inside is safe, which contradicts zero-trust principles.