In the zero-trust network access model, which criteria is used for continuous verification to modify trust levels?

Question

Options

• ASystem patching status
• BDetected threat levels
• CUser and device behavior
• DNetwork traffic patterns

• A
  2% (1)
• B
  11% (6)
• C
  81% (43)
• D
  6% (3)

Explanation

User and device behavior (C) is the cornerstone of continuous verification in Zero Trust because the model operates on "never trust, always verify" - it dynamically adjusts trust levels by monitoring how users and devices act over time, not just who they are at login. Anomalous behavior (unusual access times, atypical data requests, lateral movement) can immediately trigger re-authentication or access revocation.

Why the distractors are wrong:

• A (System patching status) is a posture check done at initial or periodic assessment, not a continuous behavioral signal that modifies trust in real time.
• B (Detected threat levels) is an output of threat intelligence feeds - it informs policy but isn't itself the behavioral criterion Zero Trust monitors per user/device session.
• D (Network traffic patterns) is analyzed as part of network monitoring (e.g., UEBA tools), but traffic patterns are a byproduct of behavior, not the primary trust criterion - the model focuses on the entity (user + device) generating that traffic.

Memory tip: Think of Zero Trust as a suspicious bouncer who never assumes regulars are safe - they watch what you do (behavior) every moment you're inside, not just whether the patches on your jacket are current or how busy the club looks.

No community discussion yet for this question.