Start with the scope of each idea
Zero Trust
An architecture that removes implicit trust and evaluates access to protected resources using identity, device and contextual evidence.
Least privilege
A permission principle: provide only the access needed, at the appropriate scope, for no longer than necessary.
Defense in depth
A strategy that layers different people, process and technology controls so one failure does not expose the entire system.
Access decision model? Zero Trust. Minimum permissions? Least privilege. Multiple complementary barriers? Defense in depth.
Zero Trust: protect resources, not a trusted network zone
NIST SP 800-207 describes a move away from static network perimeters toward users, assets and resources. A local IP address, office location or company-owned device does not create implicit trust. Authentication and authorization occur before a session is established, and policy can use changing signals.
Who or what is requesting access—user, workload or service?
Is the device known, managed, patched and in an acceptable security state?
What application, service or data is requested, and how sensitive is it?
Do location, behavior, threat and session signals change the risk?
A practical architecture needs identity services, policy decision and enforcement points, device evidence, resource inventory and useful telemetry. Microsegmentation can limit pathways, but segmentation alone is not Zero Trust. Nor is a VPN: entering a tunnel should not grant broad, permanent access.
“Verify explicitly” does not mean repeatedly asking the user for a password. It means the system makes evidence-based access decisions and can reassess them as risk or context changes.
Least privilege: reduce scope, power and duration
Least privilege applies to people, applications, processes and service identities. Start from the required task, grant the smallest usable permission set, scope it to the necessary resources and remove it when no longer needed.
Limit resources
Restrict access to the required project, system, database, folder or record set.
Limit capability
Prefer read or task-specific operations over owner, global administrator or wildcard permissions.
Limit duration
Use temporary elevation, approval and expiration instead of permanent standing privilege where feasible.
Role-based access can make permissions manageable, but a role is not automatically least-privileged. Review role design, unused permissions, shared accounts, privilege creep and non-human identities. Separation of duties adds another protection by preventing one person from completing an entire sensitive transaction alone.
Defense in depth: layer controls with different failure modes
NIST defines defense in depth as integrating people, technology and operations capabilities across multiple layers. The goal is not to buy several products that detect the same thing. Use complementary controls that prevent, detect, contain and support recovery.
Layers should provide independent value. For example, MFA may stop a stolen password, device checks may reject an unmanaged laptop, least privilege may limit a compromised session, segmentation may reduce movement and monitoring may reveal misuse that earlier controls missed.
Worked scenario: a contractor accesses a finance application
Requirement: A remote contractor needs invoice-review access for four weeks. The application contains sensitive financial records and must not expose administrative functions.
- Identify the resource and task: finance application, invoice review only.
- Verify identity: use an individual account and strong MFA; do not share a team credential.
- Evaluate the device: require an enrolled, encrypted and compliant endpoint before access.
- Apply least privilege: assign the invoice-review role to the necessary records, with an expiration date.
- Enforce contextual policy: deny or challenge anomalous sign-ins and risky sessions.
- Layer defenses: protect the endpoint, restrict application paths, encrypt data, monitor actions and maintain response procedures.
- Reassess and remove: terminate the session if risk changes and remove the account or entitlement when the contract ends.
The contextual access decision is Zero Trust. The narrow, time-bound invoice role is least privilege. The independent identity, endpoint, application, data and monitoring controls provide defense in depth.
MFA succeeded, but access is denied: troubleshoot the whole decision
Successful MFA proves only part of the request. Follow the access path instead of weakening policy:
- Identity: verify the correct account, authentication method and account state.
- Device: check enrollment, compliance, certificate, patch and security-agent signals.
- Authorization: confirm the role, group, resource scope, expiry and explicit-deny conditions.
- Context: inspect location, IP reputation, behavior, sign-in risk and session policy.
- Enforcement: review policy-decision and policy-enforcement logs using synchronized timestamps.
- Resource: confirm the application trusts the correct identity claims and is healthy.
Authentication success does not guarantee authorization. A secure design can verify identity correctly and still deny a noncompliant device, expired entitlement or risky session.
Practice checks with explanations
An employee on the corporate LAN must still pass identity, device-health and resource-policy checks. Which concept is most directly represented?
Best answer: Zero Trust, because network location does not grant implicit trust and access is evaluated for the resource.
A database administrator receives elevated permission for one approved change and the permission expires after one hour. Which principle?
Best answer: least privilege, specifically limiting capability and duration through just-in-time elevation.
MFA fails to stop a stolen session, but segmentation limits movement and EDR isolates the endpoint. Which strategy?
Best answer: defense in depth, because different layers reduce the effect of one failed control.
Common Security+ exam mistakes
- Treating Zero Trust as a single vendor product or VPN replacement.
- Assuming every internal user, workload or network is inherently safe.
- Calling MFA alone a complete Zero Trust architecture.
- Granting a broad role because role-based access sounds secure.
- Ignoring privilege duration and stale service-account permissions.
- Building several identical control layers with the same blind spot.
- Forgetting people, procedures, monitoring, response and recovery.
Frequently asked questions
Is Zero Trust a product?
No. Zero Trust is a security model and architecture built around explicit, contextual access decisions and protection of resources. Products can provide components such as identity, device posture, policy enforcement and telemetry, but one product does not create a complete Zero Trust architecture.
What is the difference between Zero Trust and least privilege?
Zero Trust is the broader architecture used to make and continually reassess access decisions. Least privilege is a principle within that architecture: grant only the permissions and access duration needed for a specific task.
What is the difference between Zero Trust and defense in depth?
Zero Trust removes implicit trust and evaluates access to resources. Defense in depth layers people, process and technology controls so that another safeguard can detect, slow or contain an attack when one control fails.
Does Zero Trust mean trusting nobody?
It means trust is not granted implicitly because a user or device is inside a network or owned by the company. Access is based on verified identity, device and contextual evidence and is limited by policy.
Is MFA enough for Zero Trust?
No. MFA strengthens identity verification, but a Zero Trust design also considers device posture, resource sensitivity, authorization, session risk, telemetry and enforcement. A strongly authenticated user can still be over-privileged or use a compromised device.
Official references
Review NIST SP 800-207, Zero Trust Architecture, the NIST glossaries for least privilege and defense in depth, and the official CompTIA Security+ page. Use the current exam objectives as the final scope authority.