A network security team observes phishing attacks on a user machine from a remote location. The organization has a policy of saving confidential data on two different systems using different types…

Assessing real-time security health is an ongoing monitoring activity that occurs after device trustworthiness has already been established, not immediately after user verification.

Enforcing risk-based and adaptive access policies is a policy enforcement step that follows both user and device verification in the Zero Trust sequence.

Zero Trust follows a structured sequence - first verify users, then verify devices, then enforce policy. After user verification is complete, confirming device trustworthiness involves checking endpoint compliance, patch level, and security posture before allowing access. This step is critical in a phishing scenario because a compromised device may persist as a threat even after the user is verified.

Applying context-based network access control is a downstream enforcement action that depends on completed user and device verification, making it a later step in the process.