What are two steps customers can take to evolve to a trust-centric security philosophy? (Choose two.)

Requiring agents on all mobile devices is an enforcement tactic that can complement Zero Trust but is not itself a philosophical step toward a trust-centric model.

Blocking BYOD is an overly restrictive policy that conflicts with the Zero Trust goal of enabling secure access for any verified user or device rather than blanket denial.

Limiting internal access alone is a partial control and does not capture the full Zero Trust principle of verifying all traffic continuously, not just restricting it.

Always verifying and never trusting is the defining principle of Zero Trust security - it eliminates implicit trust for any entity inside or outside the perimeter and requires continuous authentication and authorization.

Granting access only to authorized users and devices operationalizes least-privilege access control, a cornerstone of Zero Trust that limits the blast radius of any compromise.