Which principle is central to Zero Trust Architecture in Navy IT environments?

• A. Trust no one by default; verify every access request; enforce least-privilege; continuous monitoring; micro-segmentation.
• B. Always trust internal network users by default.
• C. Only verify external requests; internal can be trusted.
• D. Disable monitoring to improve performance.

Answer: (A)

Zero Trust Architecture is built on treating every access request as untrusted until proven otherwise. The focus is on verifying identity, device posture, and the context of the request for every access, regardless of whether it originates inside or outside the network. Enforcing least-privilege ensures users and services only have the minimum permissions needed, reducing potential damage if credentials are compromised. Continuous monitoring keeps a constant eye on activity, enabling timely detection of anomalies and dynamic adjustment of access. Micro-segmentation further limits movement within the environment by isolating workloads, so a breach in one area can’t easily spread.

This combination—verify every access, enforce minimal rights, continuously watch and adapt, and segment workloads—embodies the Zero Trust mindset and is why it’s the best fit for Navy IT environments. The other choices misapply trust assumptions (internal users trusted by default or only external requests are verified) and remove essential visibility (disabling monitoring), which would undermine Zero Trust principles.