CompTIA Security+ Preparation · lesson 25 of 45 · 25 min
The End of ‘Trust But Verify’
Traditional network security assumed that everything inside the corporate perimeter was trusted. Once you were on the internal network, you had broad access. This model is broken — attackers who breach the perimeter (via phishing, VPN exploits, or insider threats) can move laterally with minimal resistance.
Zero Trust replaces “trust but verify” with “never trust, always verify.” Every access request — regardless of whether it comes from inside or outside the network — must be authenticated, authorized, and continuously validated.
Zero Trust core principle
“Never trust, always verify.” Assume breach. Verify explicitly. Use least privilege access. Inspect and log everything.
Zero Trust Pillars
Zero Trust vs Traditional Perimeter Security
ZTNA — Zero Trust Network Access
ZTNA (Zero Trust Network Access) is the technology implementation of Zero Trust for remote access. Instead of a VPN that grants broad network access, ZTNA grants access to specific applications only — after verifying identity and device posture. The user never touches the network; they only reach the app they are authorized for.
ZTNA is often delivered as part of a SASE (Secure Access Service Edge) platform, which combines ZTNA, CASB, SWG (Secure Web Gateway), and SD-WAN into a cloud-delivered security service.
Flashcard Drill
Zero Trust “Never trust, always verify” — every access request is authenticated and authorized regardless of network location. Micro-segmentation Dividing the network into very small zones with strict access controls between them — limits lateral movement. ZTNA Zero Trust Network Access — grants per-app access after identity/device verification; replaces broad VPN access. SASE Secure Access Service Edge — cloud-delivered platform combining ZTNA, CASB, SWG, and SD-WAN. Least privilege Grant only the minimum access needed to perform a task — a core Zero Trust principle. Assume breach Zero Trust design principle — design as if attackers are already inside; limit blast radius. Identity pillar Zero Trust pillar focused on verifying every user and service identity — MFA, IdP, PAM. Device pillar Zero Trust pillar focused on verifying device health and compliance before granting access. UEBA User and Entity Behavior Analytics — detects anomalous behavior patterns that may indicate compromise. Software-defined perimeter Dynamic, identity-based network perimeter that hides resources until identity is verified.
Scenario Practice
Replacing the VPN
Add more firewall rules to the VPN — it just needs better configuration. Replace the VPN with ZTNA — grant per-app access only after identity and device verification. Require employees to come to the office — remote work is too risky. Add a second VPN for extra security. 1 ZTNA solves the VPN lateral movement problem. With ZTNA, a compromised developer account only reaches the apps that developer is authorized for — not the entire network. The finance database would be inaccessible.
Micro-segmentation
Install antivirus on all devices — that will stop the spread. Implement micro-segmentation — isolate medical devices, workstations, servers, and guest Wi-Fi into separate zones with strict inter-zone controls. Disconnect from the internet — ransomware only comes from outside. Upgrade to faster network hardware. 1 A flat network allows ransomware to spread freely via lateral movement. Micro-segmentation creates isolated zones — if ransomware infects one workstation, it cannot reach medical devices or servers in other segments.
Knowledge Check
Zero Trust — 10 Questions
What is the core principle of Zero Trust?
- Trust internal users; verify external users
- Never trust, always verify — regardless of network location
- Use VPNs for all remote access
- Block all external traffic
Answer: Never trust, always verify — regardless of network location
Zero Trust never grants implicit trust based on network location — every request is verified.
ZTNA differs from a traditional VPN because:
- ZTNA is slower
- ZTNA grants per-app access only; VPN grants broad network access
- ZTNA does not require authentication
- VPN is more secure than ZTNA
- Answer: ZTNA grants per-app access only; VPN grants broad network access
ZTNA limits access to specific authorized applications — a compromised ZTNA session cannot reach other resources.
In a Zero Trust model, users on the internal corporate network are automatically trusted.
- True
- False
Answer: False
Zero Trust eliminates implicit trust for internal users — every request is verified regardless of network location.
Dividing a network into very small isolated zones to limit lateral movement is called _____.
Answer: micro-segmentation
Micro-segmentation creates fine-grained network zones with strict access controls between them.
Which Zero Trust design principle assumes attackers are already inside the network?
- Least privilege
- Verify explicitly
- Assume breach
- Never trust
Answer: Assume breach
“Assume breach” means designing security as if attackers are already inside — focus on limiting blast radius and detecting lateral movement.
Which are pillars of Zero Trust? (Select all that apply)
- Identity
- Device
- Perimeter
- Data
- Application
Answer: Identity
Device
- Data
- Application
Zero Trust pillars include Identity, Device, Network, Application, Data, and Visibility. “Perimeter” is the old model Zero Trust replaces.
SASE combines which technologies into a cloud-delivered platform?
- VPN + firewall + antivirus
- ZTNA + CASB + SWG + SD-WAN
- IDS + IPS + SIEM
- MFA + SSO + PAM
Answer: ZTNA + CASB + SWG + SD-WAN
SASE (Secure Access Service Edge) converges ZTNA, CASB, Secure Web Gateway, and SD-WAN into a unified cloud service.
Which technology detects anomalous user behavior patterns that may indicate account compromise?
- CSPM
- UEBA
- NAC
- DLP
Answer: UEBA
UEBA (User and Entity Behavior Analytics) establishes behavioral baselines and alerts on deviations.
Least privilege is a core Zero Trust principle — users should only have the minimum access needed for their role.
- True
- False
Answer: True
Least privilege limits the blast radius of a compromised account — a key Zero Trust principle.
A software-defined perimeter hides resources until:
- The user is on the internal network
- Identity is verified and device posture is confirmed
- The firewall approves the connection
- The user has a VPN connection
- Answer: Identity is verified and device posture is confirmed
A software-defined perimeter makes resources invisible until the user proves who they are and that their device is compliant.
Previous lesson: Secure network design: NAC, proxy, reverse proxy, load balancer, WAF, SIEM, SOAR
Back to CompTIA Security+ Preparation
Next lesson: Resilience and redundancy: HA, clustering, RAID, backups, BCP/DRP