What model requires always verifying identity before granting access?

What model requires always verifying identity before granting access?

• A. Zero Trust Model
• B. Perimeter Defense
• C. Role-Based Access Control
• D. Password-Only Access

Answer: (A)

Always verifying identity before granting access is the hallmark of the Zero Trust Model. In Zero Trust, no user or device is trusted by default, even if they’re inside the network. Every access request is treated as potentially hostile and must be authenticated and authorized for that specific resource, with ongoing assessments of identity, device health, context, and risk. Access is granted only to the minimum resources needed (least privilege) and can be re-evaluated or revoked as conditions change, rather than assuming trust once you’re “inside.” Perimeter defense relies on a secure boundary and often trusts users after initial login, which contradicts the idea of continuous verification. Role-Based Access Control determines what actions a user can perform based on their role but doesn’t inherently enforce continuous re-verification for each access request. Password-only access uses a single factor for authentication and doesn’t address ongoing verification or device/context checks.

Always verifying identity before granting access is the hallmark of the Zero Trust Model. In Zero Trust, no user or device is trusted by default, even if they’re inside the network. Every access request is treated as potentially hostile and must be authenticated and authorized for that specific resource, with ongoing assessments of identity, device health, context, and risk. Access is granted only to the minimum resources needed (least privilege) and can be re-evaluated or revoked as conditions change, rather than assuming trust once you’re “inside.”

Perimeter defense relies on a secure boundary and often trusts users after initial login, which contradicts the idea of continuous verification. Role-Based Access Control determines what actions a user can perform based on their role but doesn’t inherently enforce continuous re-verification for each access request. Password-only access uses a single factor for authentication and doesn’t address ongoing verification or device/context checks.