Zero Trust solutions fundamentally change how connectivity and security are delivered compared to legacy controls. They decouple security from the network, directly connecting an authenticated user to an authorized application. This provides secure access for any user, on any device, from any location, but only after their identity and context are verified and the request is deemed compliant with policy. This eliminates the need for traditional network access (like VPNs) and the associated attack surface, providing a superior security posture and user experience.

A. While Zero Trust does ensure correct authorization, this is only one part of its advantage; the statement is not as comprehensive as option B.

C. This describes a traditional hub-and-spoke network or VPN model, where users are connected to a network, not directly to applications, which is what Zero Trust replaces.

D. This describes a significant disadvantage and complexity of legacy, IP-based controls, which Zero Trust architectures are designed to overcome by using identity instead of IP addresses for policy.

1. Zscaler. (2023). ZTCA Certification Study Guide. "Zero Trust solutions offer significant advantages over legacy network controls by delivering connectivity, regardless of network or location, but only for authorized and compliant requests. This approach eliminates the broad network access provided by VPNs." (Section: Comparing Zero Trust to Legacy Architectures).

2. Zscaler. "What Is Zero Trust?". "Unlike traditional network security that trusts anyone and anything inside the network, a zero trust architecture trusts no one and nothing. It provides secure connections between users and applications, regardless of who they are or where they are." (Section: How Does Zero Trust Work?).