Zero Trust assumes no implicit trust inside the network—verify every user, device, and request continuously.
Principles
- Verify explicitly (strong auth)
- Least privilege access
- Assume breach—monitor and segment
Contrast
Old "castle and moat" VPN trust once inside—insiders and stolen laptops break that model.
Important interview questions and answers
- Q: Zero Trust means no firewall?
A: No—still segment; add identity-aware policies. - Q: Device posture?
A: Check patch level/compliance before granting app access.
Self-check
- State one Zero Trust principle.
- VPN alone vs Zero Trust intuition?
Tip: MFA + device compliance beats VPN alone for remote workforce.
Interview prep
- Assume breach?
Design monitoring and segmentation knowing intrusion may occur.