What security model requires authentication for every request, regardless of network location?

What security model requires authentication for every request, regardless of network location?

• A. Identity-based Access
• B. Zero Trust
• C. Perimeter Defense
• D. Segmentation

Answer: (B)

Requiring authentication for every request, regardless of where it comes from, is the essence of Zero Trust. In this approach, no trust is granted based on network location or a supposed secure inside; every access attempt is explicitly authenticated and authorized, and decisions are continuously evaluated as context changes—identity, device health, time, location, and risk. This minimizes the chance that a compromised credential or insider could abuse a trusted session, and it relies on practices like MFA, short-lived tokens, encryption, and policies that enforce least privilege along with ongoing monitoring and verification. Identity-based Access focuses on tying permissions to who you are, but it doesn’t inherently mandate per-request verification across all network contexts. Perimeter Defense relies on protecting a boundary and often assumes that anything inside is trusted, which contradicts the “verify every request” mindset. Segmentation helps limit movement within a network, but by itself it doesn’t require perpetual authentication for each interaction across all locations.

Requiring authentication for every request, regardless of where it comes from, is the essence of Zero Trust. In this approach, no trust is granted based on network location or a supposed secure inside; every access attempt is explicitly authenticated and authorized, and decisions are continuously evaluated as context changes—identity, device health, time, location, and risk. This minimizes the chance that a compromised credential or insider could abuse a trusted session, and it relies on practices like MFA, short-lived tokens, encryption, and policies that enforce least privilege along with ongoing monitoring and verification.

Identity-based Access focuses on tying permissions to who you are, but it doesn’t inherently mandate per-request verification across all network contexts. Perimeter Defense relies on protecting a boundary and often assumes that anything inside is trusted, which contradicts the “verify every request” mindset. Segmentation helps limit movement within a network, but by itself it doesn’t require perpetual authentication for each interaction across all locations.