What enables zero trust to be properly implemented and enforced between an originator and the...

Zscaler Access Control Services support Zero Trust by enforcing segmentation and conditional access instead of allowing broad network reach. Preventing lateral movement requires connecting users to specific applications and limiting what they can discover or reach beyond that entitlement. Option B (Access is granted without sharing the network between the originator and the destination application) is correct because segmentation and conditional access are the controls that reduce lateral-movement risk.

Why the other options are incorrect:

A. Trusted network criteria designate the locations of originators which can be trusted: Trusted Network detection decides whether the device is on a known corporate network using signals such as DNS servers, search domains, gateways, or hostname resolution.

C. Cloud firewall policies ensure that only authenticated users are allowed access to destination applications: Zscaler Cloud Firewall enforces network-service and application rules for non-web and firewall-controlled traffic.

D. Connectivity between the originator and the destination application is over IPSec tunnels: IPS inspects traffic inline for exploit signatures and attack patterns, then blocks or resets offending sessions.