Which of the following should be an IS auditor's PRIMARY focus when auditing an organization's transition to a Zero Trust architecture?

The correct answer is A. Verifying access requests are authenticated and authorized before access is granted. In a Zero Trust architecture, the primary principle is to never trust, always verify. Therefore, the IS auditor's primary focus should be on verifying that all access requests are properly authenticated and authorized before access is granted - regardless of the user's location…

Submitted by kev92· Apr 18, 2026Information Security Program Development and Management

Question

Options

AVerifying access requests are authenticated and authorized before access is granted
BEnsuring legacy systems are phased out completely
CAssessing the adequacy and effectiveness of perimeter defenses such as firewalls
DReviewing the frequency of required password changes for users

How the community answered

(42 responses)

A
79% (33)
B
2% (1)
C
14% (6)
D
5% (2)

Explanation

In a Zero Trust architecture, the primary principle is to never trust, always verify. Therefore, the IS auditor's primary focus should be on verifying that all access requests are properly authenticated and authorized before access is granted - regardless of the user's location or network.

Topics

#Zero Trust Architecture#IS Audit#Access Control#Authentication and Authorization

Community Discussion

No community discussion yet for this question.

Full CISM Practice