Zero Trust: Never Trust, Always Verify
The modern security model that assumes breach and verifies everything. Three principles, six pillars — and the exam tests them constantly.
What is Zero Trust?
Imagine a building where everyone shows ID at every door — not just the front entrance.
The old security model was like a castle with a moat: once you got past the front gate (the corporate firewall), you were trusted everywhere. Walk freely, open any office, access any file.
Zero Trust says: no. Every door checks your ID. Every time. Even if you just walked through the door next to it. Even if you work here. Even if you’ve been here for 20 years.
Why? Because threats come from inside too. A stolen password, a compromised laptop, a disgruntled employee — if they’re already “inside,” the old model can’t stop them.
The three core principles
These three principles appear in nearly every security question on the exam:
| Principle | What It Means | Example |
|---|---|---|
| Verify explicitly | Always authenticate and authorise based on all available data points | Check the user’s identity, device health, location, AND the sensitivity of what they’re accessing |
| Use least privilege access | Give only the minimum permissions needed, for only as long as needed | Sam gives Tina “store manager” access, not “global admin.” Elevated access expires after 4 hours. |
| Assume breach | Design systems as if an attacker is already inside | Segment networks, encrypt data, monitor for anomalies, limit blast radius |
Exam tip: recognising Zero Trust principles in questions
The exam often describes a scenario and asks “which Zero Trust principle does this follow?”
Pattern recognition:
- If the answer involves checking multiple factors before granting access → Verify explicitly
- If the answer involves limiting permissions or time-bound access → Least privilege
- If the answer involves monitoring, segmentation, or encryption → Assume breach
Sometimes questions combine principles: “Check device compliance (verify explicitly) and grant read-only access for 2 hours (least privilege).”
Zero Trust vs the old model
| Feature | Zero Trust | Traditional (Castle-and-Moat) |
|---|---|---|
| Trust model | Never trust, always verify | Trust everything inside the network |
| Network location | Not a factor in trust decisions | Inside = trusted, outside = untrusted |
| Access control | Least privilege, just-in-time | Broad access once authenticated |
| Verification | Continuous — every request | Once — at the perimeter |
| Breach assumption | Designs for breach from day one | Assumes perimeter will hold |
| Remote work | Works perfectly — location doesn't matter | Requires VPN to 'get inside' |
The six pillars of Zero Trust
Microsoft implements Zero Trust across six areas. Think of each pillar as a door that checks your ID independently:
| Pillar | What It Covers | Microsoft Service |
|---|---|---|
| Identity | Users, service accounts, devices requesting access | Microsoft Entra ID (MFA, Conditional Access) |
| Devices | Device health and compliance | Intune, Defender for Endpoint |
| Applications | App permissions and shadow IT | Defender for Cloud Apps, app consent policies |
| Data | Data classification and protection | Microsoft Purview (labels, DLP, encryption) |
| Infrastructure | Server and cloud resource security | Microsoft Defender for Cloud, secure configurations |
| Network | Network segmentation and monitoring | Azure Firewall, NSGs, Global Secure Access |
Scenario: Sam implements Zero Trust at BrightStar
Sam decides BrightStar Retail needs proper security. Here’s how Zero Trust applies:
- Identity: All 50 employees use MFA — even in the store
- Devices: Only company-managed tablets and laptops can access inventory data
- Applications: Employees can’t install random apps that connect to company data
- Data: Customer payment information is encrypted and labelled “Confidential”
- Infrastructure: The POS system runs on a separate network segment
- Network: Store Wi-Fi for customers is completely isolated from the business network
The result: When a phishing email compromises Tina’s password, MFA blocks the attacker. Even if they bypass MFA, they can only access Tina’s store-manager resources — not the financial system.
Common Zero Trust misconceptions
| Misconception | Reality |
|---|---|
| ”Zero Trust means zero access” | No — it means verified access, not no access |
| ”It’s a single product you buy” | No — it’s a strategy applied across products and services |
| ”It replaces firewalls” | No — firewalls are one layer within Zero Trust (the network pillar) |
| “Only for big enterprises” | No — even a 50-person business like BrightStar can implement it |
🎬 Video walkthrough
Flashcards
Knowledge Check
Raj at Lakewood University needs to give Professor Chen temporary admin access to set up a new course site. The access should expire automatically after 48 hours. Which TWO Zero Trust principles does this demonstrate? (Select 2)
Sam wants to ensure that even if an employee's password is stolen, an attacker cannot access BrightStar's inventory system. Which Zero Trust principle should Sam prioritise?