Practice vocabulary for Zero Trust security architecture including never trust always verify, microsegmentation, continuous verification, least-privilege access, and device health checks.
0 / 15 completed
1 / 15
The core principle of Zero Trust is summarized as _____.
'Never trust, always verify' is the foundational Zero Trust principle — no user, device, or network location is inherently trusted; every access request must be authenticated and authorized.
2 / 15
'Microsegmentation' in Zero Trust means _____.
Microsegmentation divides the network into isolated zones, enforcing granular access policies between them — limiting lateral movement if an attacker breaches one segment.
3 / 15
'Identity is the new perimeter' in Zero Trust means that _____.
In Zero Trust, since users work from anywhere and the network boundary is dissolving, identity verification (who you are, not where you are) becomes the primary access control boundary.
4 / 15
'Least-privilege access at every layer' means users and services are given _____.
Least privilege limits the blast radius of a compromised account or service — if an attacker gains access, they can only reach the minimal set of resources that identity was permitted to use.
5 / 15
Before a device can access corporate resources under a Zero Trust model, it must _____.
Device health checks (also called device compliance checks) verify that the endpoint meets security requirements before granting access — ensuring compromised or unpatched devices cannot reach resources.
6 / 15
Alice, a security engineer, is reviewing a PR submitted by Bob. Bob's code accesses the database directly without any intermediate abstraction layers. Alice comments: 'I'm concerned about this direct database access – it violates Zero Trust principles. We should enforce least-privilege access and consider using an API gateway.' Which of the following best explains Alice's concern?
Alice's comment highlights a key aspect of Zero Trust: minimizing attack surfaces. Direct database access eliminates layers of security controls that would normally be present—like rate limiting or authentication checks—creating an unnecessary risk. Enforcing least-privilege access and abstraction are critical to mitigating this vulnerability.
7 / 15
David, a DevOps engineer, is drafting the description for a Pull Request that introduces a new service connecting to an external API. He writes: 'This PR adds a connection to the ExternalServiceAPI. The service has full access to our internal network.' Which statement best reflects a Zero Trust approach to this situation?
Zero Trust dictates a skeptical approach – never assume trust based solely on location or source. Granting 'full access' without further constraints creates a significant vulnerability. Instead, strong authentication, granular authorization rules (based on the principle of least privilege), and continuous monitoring are crucial to verify the service's behavior and prevent unauthorized actions.
8 / 15
Sarah, a development team lead, is explaining Zero Trust to her team during a standup. She says: 'We're moving towards a model where every user and device needs to be verified *before* accessing any resource, regardless of whether they're on the internal network.' What does Sarah primarily mean by this statement?
Sarah's statement focuses on the core principle of Zero Trust: eliminating implicit trust. The traditional perimeter-based security model assumes that anyone inside the network is trusted. Zero Trust flips this approach, requiring constant verification – hence continuous authentication and validation—for *every* access request, regardless of location.
9 / 15
Mark, a security analyst, is investigating an incident where a compromised server was able to pivot laterally across the network. The investigation revealed that the server had been granted excessive permissions and lacked multi-factor authentication. Considering Zero Trust principles, what action would be MOST effective in preventing similar incidents?
While the other options are valuable security practices, they don't directly address the root cause of the lateral movement – excessive permissions. Enforcing least privilege access, combined with multi-factor authentication (MFA), dramatically reduces the impact of a compromised account and limits the potential for attackers to move laterally across the network. This is at the heart of Zero Trust's approach.
10 / 15
Emily, a software architect, is designing a new microservice that needs to access data in another service. She wants to implement Zero Trust principles. Which of the following best describes the correct approach?
Mutual TLS (mTLS) provides strong authentication and encryption for communication between services, ensuring that only authorized services can access data. It's a core component of Zero Trust because it verifies the identity of both parties involved in the exchange – preventing unauthorized access regardless of network location. Relying solely on VPNs or shared tokens is insufficient for a robust Zero Trust architecture.
11 / 15
Alice, a security engineer, is reviewing a PR submitted by Bob. Bob's code accesses the database directly without any intermediate abstraction layers. Alice comments: 'I'm concerned about this direct database access – it violates Zero Trust principles. We should enforce least-privilege access and consider using an API gateway.' Which of the following best explains Alice's concern?
Alice's comment highlights a key aspect of Zero Trust: minimizing attack surfaces. Direct database access eliminates layers of security controls that would normally be present—like rate limiting or authentication checks—creating an unnecessary risk. Enforcing least-privilege access and abstraction are critical to mitigating this vulnerability.
12 / 15
David, a DevOps engineer, is drafting the description for a Pull Request that introduces a new service connecting to an external API. He writes: 'This PR adds a connection to the ExternalServiceAPI. The service has full access to our internal network.' Which statement best reflects a Zero Trust approach to this situation?
Zero Trust dictates a skeptical approach – never assume trust based solely on location or source. Granting 'full access' without further constraints creates a significant vulnerability. Instead, strong authentication, granular authorization rules (based on the principle of least privilege), and continuous monitoring are crucial to verify the service's behavior and prevent unauthorized actions.
13 / 15
Sarah, a development team lead, is explaining Zero Trust to her team during a standup. She says: 'We're moving towards a model where every user and device needs to be verified *before* accessing any resource, regardless of whether they're on the internal network.' What does Sarah primarily mean by this statement?
Sarah's statement focuses on the core principle of Zero Trust: eliminating implicit trust. The traditional perimeter-based security model assumes that anyone inside the network is trusted. Zero Trust flips this approach, requiring constant verification – hence continuous authentication and validation—for *every* access request, regardless of location.
14 / 15
Mark, a security analyst, is investigating an incident where a compromised server was able to pivot laterally across the network. The investigation revealed that the server had been granted excessive permissions and lacked multi-factor authentication. Considering Zero Trust principles, what action would be MOST effective in preventing similar incidents?
While the other options are valuable security practices, they don't directly address the root cause of the lateral movement – excessive permissions. Enforcing least privilege access, combined with multi-factor authentication (MFA), dramatically reduces the impact of a compromised account and limits the potential for attackers to move laterally across the network. This is at the heart of Zero Trust's approach.
15 / 15
Emily, a software architect, is designing a new microservice that needs to access data in another service. She wants to implement Zero Trust principles. Which of the following best describes the correct approach?
Mutual TLS (mTLS) provides strong authentication and encryption for communication between services, ensuring that only authorized services can access data. It's a core component of Zero Trust because it verifies the identity of both parties involved in the exchange – preventing unauthorized access regardless of network location. Relying solely on VPNs or shared tokens is insufficient for a robust Zero Trust architecture.
Practice vocabulary for Zero Trust security architecture including never trust always verify, microsegmentation, continuous verification, least-privilege access, and device health checks.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Identity & Access Management exercises?
Browse the full Identity & Access Management hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.