What characterizes a zero-trust security model in an enterprise ISSAP approach?

• A. Zero trust assumes no implicit trust; verify continuously, enforce least privilege, identity-based microsegmentation, and continuous monitoring.
• B. Once authenticated, trust is granted indefinitely.
• C. Trust is based on IP address.
• D. Zero trust means ignoring identity verification.

Answer: (A)

Zero trust treats every access request as untrusted by default and enforces verification and policy-based access every time a resource is accessed. Verification is continuous and context-aware, considering identity, device posture, user role, data sensitivity, and location before granting authorization. The model enforces least privilege, giving users and devices only the permissions they truly need. Identity-based microsegmentation restricts movement within the network by enforcing access based on identity and policy rather than broad network segments, reducing potential lateral movement for attackers. Continuous monitoring and risk-based adaptive controls watch for anomalies and change conditions, revoking or adjusting access as needed. This approach contrasts with models that grant ongoing trust after initial authentication, rely on IP or network location to define trust, or ignore identity verification.