In a Zero Trust architecture, should applications that you manage have any exposed inbound listeners?

The correct answer is A . A major principle of Zero Trust architecture is that managed applications should not be broadly discoverable or openly reachable in the way legacy internet-facing services often are. Access should be limited only to explicitly authorized initiators , and all other visibility and reachability should be denied. This reduces attack surface, prevents opportunistic scanning, and limits exposure to exploitation attempts before authentication and policy evaluation occur.

Zero Trust does not assume that a firewall alone is sufficient protection for an exposed application. Instead, it seeks to minimize or eliminate unnecessary public exposure in the first place. Likewise, requiring the user to be on the same network is a legacy network-trust model, not a Zero Trust principle. The correct model is that access is granted only after identity and context are verified and policy allows it .

So while an application may technically listen for approved brokered access, it should not be openly visible to unauthorized users or the general internet. Therefore, the best answer is that inbound access should be available only to permitted initiators , while all other access and visibility are denied.