Connections to destination applications are the same, regardless of location or function.

This statement is false. In a Zero Trust architecture, connections are highly contextual and are not treated the same. The security policies applied to a connection are granular and depend on multiple factors, including the identity of the user, the posture of the device, the user's location, and the sensitivity of the destination application. For example, a user on a managed corporate device accessing a low-risk application will have a different policy enforced than the same user on an unmanaged personal device trying to access sensitive financial data. This principle of least-privileged, context-aware access is central to Zero Trust.

This question is a True/False statement. The statement is false (B) because Zero Trust mandates that access policies are granular and context-dependent. Option A (True) would be incorrect as it suggests a monolithic security approach, which is what Zero Trust is designed to replace.

1. Zscaler. (2023). Zero Trust Certified Architect (ZTCA) Certification Guide. Page 6, "Zero trust authenticates and authorizes every connection on a case-by-case basis... This is called least-privileged access."

2. Zscaler. (n.d.). The Zscaler Zero Trust Exchange. Zscaler Products. Retrieved from https://www.zscaler.com/products/zero-trust-exchange. The platform is designed to "Securely connect the right user to the right app, based on identity and context." This highlights that connections are differentiated.