Which set correctly lists the three guiding principles of Zero Trust?
A.Trust but verify, encrypt everything, centralize control
'Trust but verify' is the opposite philosophy — Zero Trust starts from no implicit trust.
B.Verify explicitly, use least privilege access, assume breach
Correct — the three official Zero Trust principles.
C.Perimeter defense, VPN for all users, on-premises first
Perimeter-centric thinking is what Zero Trust replaces.
D.Automate everything, monitor continuously, patch regularly
Good operational practices, but not the named Zero Trust principles.
Why this answer
The Zero Trust model: (1) verify explicitly — authenticate and authorize using all available signals; (2) least privilege — just-enough, just-in-time access; (3) assume breach — design as if attackers are already inside. 'Never trust, always verify' is the tagline.
Correct answer: B · Last reviewed 2026-02-13
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Identity & Access practice session.
Practice Identity & Access