Governance, Ethics, AI, and Future Network Security

Introduction

Network security is not only a technical activity. Firewalls, encryption, intrusion detection, and secure configurations are effective only when they operate within a system of accountable decisions. Governance establishes who is responsible for security, which risks are acceptable, how decisions are documented, and how compliance is demonstrated. Ethics determines how security powers should be used, especially when monitoring employees, investigating incidents, collecting personal data, or deploying artificial intelligence (AI). Legal duties establish minimum obligations, while professional standards and frameworks provide practical methods for meeting them.

This chapter examines network security as a strategic and socio-technical discipline. It connects policy, standards, privacy, legal responsibility, supply-chain risk, managerial reporting, AI-assisted defense, AI-enabled attacks, automation, post-quantum readiness, and emerging trends. The emphasis is on practical foundations appropriate for cybersecurity professionals who must communicate with technical teams, managers, suppliers, regulators, and affected users.

Learning Objectives

By the end of this chapter, you should be able to:

1. Explain the relationship among governance, policy, standards, procedures, law, and ethics.
2. Compare the purposes of NIST Cybersecurity Framework and ISO/IEC 27001-based information security management.
3. Apply principles of privacy, professional ethics, accountability, and responsible disclosure.
4. Identify vendor, third-party, and software supply-chain risks and suitable controls.
5. Prepare meaningful security reports for managers and decision makers.
6. Describe responsible uses and limitations of AI in defensive security.
7. Recognize AI-enabled attack methods, automation risks, and human oversight requirements.
8. Explain why organizations should begin post-quantum cryptography planning.
9. Evaluate emerging security trends using risk, evidence, and governance rather than hype.

1. Governance as the Foundation of Security

Governance is the system by which an organization is directed, controlled, and held accountable. Cybersecurity governance aligns security activities with organizational objectives, legal requirements, risk appetite, and stakeholder expectations. It is distinct from day-to-day management. Governance determines direction and accountability; management plans and executes activities within that direction.

A useful hierarchy is:

A policy is not effective merely because it exists. It should have an owner, scope, approval authority, review date, enforcement mechanism, exception process, and relationship to risk. Policies should be understandable to their intended users and supported by training and technical controls.

Governance responsibilities

The board or governing body normally approves risk appetite and receives assurance about material cyber risk. Senior management allocates resources and accepts or treats risk. The chief information security officer, where present, develops the security program and advises leadership. System owners remain accountable for the systems and information they operate. Legal, privacy, procurement, human resources, internal audit, and business continuity functions contribute specialized oversight.

Accountability should not be confused with the claim that one person is always at fault. Effective governance distributes duties while preserving clear ownership. A responsibility matrix, such as RACI, can identify who is Responsible, Accountable, Consulted, and Informed for activities including vulnerability remediation, incident notification, supplier approval, and data retention.

2. Risk, Compliance, and Assurance

Security governance is risk-based. Risk assessment considers assets, threats, vulnerabilities, consequences, and existing controls. A simple qualitative model may classify risk as low, medium, or high, but labels must be supported by defined criteria. For example, an internet-facing vulnerability affecting a payment service may be high because exploitation is plausible and the consequences include financial loss, regulatory exposure, and service interruption.

Risk treatment generally involves four choices:

• Avoid: discontinue the activity creating unacceptable risk.
• Reduce: implement controls that lower likelihood or impact.
• Transfer or share: use insurance, contractual allocation, or an external service, while recognizing that accountability is rarely eliminated.
• Accept: consciously retain the risk within approved tolerance.

Compliance is evidence that specified requirements have been met. Compliance is valuable, but it is not identical to security. An organization can satisfy a checklist while remaining vulnerable to an unanticipated threat. Conversely, a strong control may be sensible even when no regulation explicitly requires it. Assurance combines policy review, testing, audits, metrics, interviews, technical evidence, and management confirmation.

3. NIST and ISO Frameworks

NIST Cybersecurity Framework

The NIST Cybersecurity Framework (CSF), especially its current CSF 2.0 structure, is a flexible way to organize cybersecurity outcomes. Its six functions are:

1. Govern: establish and monitor the organization’s cybersecurity strategy, expectations, and policy.
2. Identify: understand assets, risks, suppliers, and business context.
3. Protect: implement safeguards such as access control, training, and data security.
4. Detect: discover and analyze possible cybersecurity events.
5. Respond: contain, communicate, and manage incidents.
6. Recover: restore services and improve after disruption.

The functions are not a strictly linear incident sequence. Governance applies throughout the lifecycle, and organizations may perform activities in several functions simultaneously. Profiles can describe current and target outcomes, while implementation tiers help characterize the rigor and integration of risk management.

ISO/IEC 27001 and the ISMS

ISO/IEC 27001 specifies requirements for an Information Security Management System (ISMS). An ISMS is a management system, not merely a set of technical safeguards. It requires defined scope, leadership commitment, risk assessment, risk treatment, objectives, documented information, competence, monitoring, internal audit, management review, and continual improvement. Annex A provides a reference set of controls, but organizations select controls according to their risk treatment and justify applicability.

The central distinction is that NIST CSF is commonly used as an outcome-oriented organizing framework, whereas ISO/IEC 27001 is a certifiable management-system standard when assessed by an appropriate certification body. They can be used together: an organization may use NIST outcomes to structure its program and ISO/IEC 27001 requirements to establish repeatable governance and assurance.

Other relevant resources include NIST publications on risk management, incident handling, privacy, and secure software development; ISO/IEC 27002 guidance for information-security controls; ISO/IEC 27701 for privacy information management; and sector-specific requirements. Frameworks should be mapped carefully rather than treated as interchangeable labels.

4. Law, Privacy, and Professional Ethics

Legal requirements vary by jurisdiction and sector. Common areas include data protection, breach notification, electronic communications, critical infrastructure, intellectual property, employment, records retention, and computer misuse. Organizations should obtain qualified legal advice for applicable jurisdictions; a general security practitioner should not assume that one country’s rules apply globally.

Privacy concerns the appropriate collection, use, disclosure, retention, and protection of information relating to identifiable people. Important principles commonly found in privacy regimes include:

• Lawfulness and transparency: people should understand relevant processing and its legal basis.
• Purpose limitation: use data for specified, legitimate purposes.
• Data minimization: collect and retain what is reasonably necessary.
• Accuracy: maintain reliable information.
• Storage limitation: do not retain personal data indefinitely without justification.
• Integrity and confidentiality: protect against unauthorized access, alteration, and loss.
• Accountability: be able to demonstrate compliance.

Security monitoring illustrates a genuine tension. Centralized logs can detect attacks, but logs may contain usernames, locations, message content, or behavioral profiles. A proportionate design defines the purpose, limits access, protects the logs, sets retention periods, and uses aggregation or pseudonymization where feasible. Employee monitoring should be transparent, lawful, necessary, and proportionate rather than covert by default.

Professional ethics adds duties beyond minimum legal compliance. A security practitioner should act with competence, honesty, confidentiality, respect for authorized boundaries, and concern for public safety. Penetration testing must have written authorization, a defined scope, safety controls, and reporting procedures. Unauthorized experimentation—even when intended to help—may cause harm or violate law.

Responsible disclosure normally involves privately reporting a vulnerability to the affected party, providing sufficient technical evidence, allowing reasonable time for remediation, coordinating public communication, and avoiding unnecessary exposure of personal or sensitive information. Emergency situations may justify accelerated disclosure, but decisions should be documented and guided by risk to users.

5. Vendor and Software Supply-Chain Risk

Organizations depend on cloud providers, managed security services, telecommunications carriers, hardware manufacturers, open-source packages, contractors, and software-update channels. This creates concentration risk, inherited vulnerabilities, dependency confusion, malicious updates, compromised credentials, counterfeit components, and uncertainty about subcontractors.

Supply-chain governance begins before procurement. A risk-based supplier assessment should consider:

• the data and privileges the supplier will access;
• service criticality and recovery requirements;
• security certifications and independent assurance reports;
• vulnerability and patch-management practices;
• software composition and provenance;
• subcontractor and fourth-party dependencies;
• incident-notification timelines;
• data location, retention, deletion, and exit arrangements;
• identity, logging, encryption, and administrative access;
• resilience, concentration, and geopolitical risks.

Contracts should define security requirements, audit or assurance rights, breach notification, evidence obligations, minimum support periods, vulnerability handling, service levels, recovery objectives, and secure termination. Procurement should not accept a certificate as proof that every risk is solved. Certification has scope, time, and assurance limitations.

Technical practices include software bills of materials (SBOMs), signed releases, reproducible or verifiable builds where feasible, dependency pinning, protected build pipelines, artifact integrity checks, least-privilege supplier access, network segmentation, and continuous monitoring. An SBOM improves visibility, but it does not prove that components are safe; it must be combined with vulnerability intelligence and response capability.

6. Reporting Security to Managers

Technical findings become strategically useful when they explain business consequence, uncertainty, options, and required decisions. A report should identify the affected service or information, threat scenario, evidence, likelihood, impact, existing controls, residual risk, recommended action, owner, due date, and decision required.

Useful measures include patch latency, percentage of assets with known owners, privileged-account coverage by multifactor authentication, backup restoration success, phishing-reporting behavior, mean time to detect, and mean time to contain. Metrics must have defined populations and measurement periods. For example, “92% patched” is incomplete without stating whether the denominator is all assets, internet-facing assets, or critical assets, and what patch threshold applies.

A basic risk-prioritization score may be used as an internal aid:

Here, R is a qualitative or ordinal risk score, L is the assigned likelihood, and I is the assigned impact. The calculation is not a universal law and should not be interpreted as a precise probability of loss. It is applicable only when the organization has defined consistent scales and accepts the limitations of multiplying ordinal values.

A stronger management report combines numbers with narrative. It explains trends, assumptions, control effectiveness, and decisions that cannot be reduced to a single score. It should avoid alarmism, unexplained technical jargon, and false precision.

7. Responsible AI-Assisted Defense

AI can assist defensive work by classifying alerts, identifying anomalous behavior, summarizing incidents, extracting indicators, prioritizing vulnerabilities, generating detection rules, and supporting threat-intelligence analysis. Large language models can help draft documentation or query examples, but their output requires verification. AI systems generate plausible text, not guaranteed truth.

A responsible AI control model includes:

1. Purpose definition: specify the security task and acceptable use.
2. Data governance: classify training, prompt, telemetry, and output data; exclude secrets and unnecessary personal data.
3. Validation: test accuracy, false positives, false negatives, bias, robustness, and failure modes.
4. Human oversight: require a qualified person to review consequential recommendations or actions.
5. Access control: limit who can use the system and what tools it can invoke.
6. Logging and traceability: record inputs, model versions, outputs, actions, and approvals where lawful.
7. Change management: reassess the system after model, data, or integration changes.
8. Incident response: define what happens when the model is manipulated, leaks data, or makes a harmful recommendation.

AI systems introduce distinctive threats. Prompt injection may cause a model connected to tools to ignore intended instructions. Data poisoning can corrupt training or retrieval sources. Model extraction, evasion, sensitive-data leakage, and excessive agency can undermine confidentiality and control. A defensive AI agent should therefore operate with least privilege, constrained tools, transaction limits, sandboxing, approval gates, and reversible actions.

AI should augment, not automatically replace, professional judgment in high-impact decisions such as disabling production services, attributing an attack, accusing an employee, or notifying regulators. Human review must be meaningful: the reviewer needs adequate time, evidence, authority, and competence to reject the recommendation.

8. AI-Enabled Attacks and Automation

Attackers use AI to improve phishing language, multilingual social engineering, reconnaissance, malware variation, credential attacks, deepfake voice or video, and vulnerability research. AI lowers the cost of personalization and increases the volume of plausible deception. Defenders should respond with layered controls rather than attempting to detect “AI writing” as a single reliable signal.

Practical measures include phishing-resistant multifactor authentication, verification of sensitive payment or identity-change requests through independent channels, secure email controls, least privilege, endpoint protection, rapid patching, anomaly detection, and staff training based on realistic scenarios. Authentication should rely on cryptographic or organizational evidence rather than confidence in a voice or message style.

Automation improves speed but can amplify mistakes. A poorly designed automated response may isolate essential infrastructure, delete evidence, or spread a misconfiguration. Safe automation uses a graduated model:

• Observe: collect and classify without changing systems.
• Recommend: propose an action for approval.
• Assist: execute low-risk, reversible actions with oversight.
• Automate: execute bounded actions under explicit conditions and continuous monitoring.

The appropriate level depends on reversibility, blast radius, confidence, and business criticality. Break-glass procedures, rate limits, allowlists, rollback, and independent monitoring are essential.

9. Post-Quantum Readiness

Quantum computing threatens some widely used public-key cryptography if sufficiently capable fault-tolerant quantum computers become available. Shor’s algorithm is relevant to factoring and discrete-logarithm problems used by systems such as RSA and elliptic-curve cryptography. Grover’s algorithm can reduce the effective security margin of exhaustive search against symmetric primitives, although the practical implications differ from the public-key threat.

The immediate governance issue is “harvest now, decrypt later”: adversaries may collect encrypted traffic today and attempt decryption in the future. Organizations should begin with cryptographic inventory and dependency mapping. They should identify where public-key encryption, digital signatures, certificates, key exchange, firmware signing, VPNs, archives, and long-lived confidential data are used.

Post-quantum cryptography (PQC) uses mathematical problems believed to resist known quantum attacks. Migration should follow standards and authoritative guidance, use crypto-agility, test interoperability and performance, and avoid unverified algorithms. Hybrid key-establishment approaches may be appropriate during transition when specified and implemented correctly. Crypto-agility means the ability to replace algorithms, keys, and protocols without redesigning every application.

PQC is not a reason to abandon current security controls. It is a lifecycle and architecture issue involving inventory, procurement, software updates, certificate management, supplier coordination, and prioritization of information whose confidentiality must last many years.

10. Emerging Trends and Critical Evaluation

Important developments include zero-trust architectures, secure-by-design regulation and procurement, confidential computing, identity-centric security, software supply-chain transparency, extended detection and response, cloud-native security, operational technology protection, and privacy-enhancing technologies. Each can improve security, but none is a universal solution.

Zero trust is a set of principles—not a product—that emphasizes explicit verification, least privilege, continuous evaluation, and assuming that network location alone does not establish trust. Confidential computing can protect data during certain processing operations, but it does not automatically solve application vulnerabilities, endpoint compromise, or misuse by authorized users.

Security leaders should evaluate trends through questions such as:

• What risk is being reduced, and how is that reduction demonstrated?
• What new dependencies, failure modes, or privacy concerns are introduced?
• Which controls, skills, and operating processes are required?
• Can the organization monitor, audit, update, and eventually retire the technology?
• Is the proposal supported by evidence relevant to this organization?

This approach prevents “technology-first” procurement and supports sustainable security improvement.

Applied Case: Illustrative Regional Health Network

Background

A fictional regional health network operates hospitals, clinics, a patient portal, medical devices, and cloud-based laboratory services. It has experienced repeated phishing attempts and relies on several suppliers for clinical applications and remote support.

Problem

An external review found that the network had an acceptable-use policy but no complete asset inventory, inconsistent supplier clauses, excessive vendor privileges, and management reports based mainly on the number of blocked attacks. A proposed AI assistant would automatically disable accounts judged suspicious. The organization also had no plan for long-lived encrypted patient archives if public-key algorithms later required replacement.

Analysis

The policy existed without sufficient governance, measurement, or technical enforcement. Supplier risk was material because vendors could access clinical systems and sensitive data. The proposed AI action had a large blast radius and could interrupt patient care if a legitimate clinician were misclassified. Attack counts measured activity, not resilience or risk reduction. Long-lived health records made cryptographic inventory and future migration important.

Approach and solution

The network established an executive cyber-risk committee and assigned system and supplier owners. It used NIST CSF functions to organize target outcomes and began an ISO/IEC 27001-aligned ISMS project. A critical-asset inventory was created, and suppliers were ranked by access, data sensitivity, and service criticality.

Contracts were revised to require timely incident notification, controlled privileged access, evidence of security practices, subcontractor disclosure, and secure termination. Vendor access moved to named accounts, multifactor authentication, time limits, approval, session logging, and segmentation.

The AI assistant was restricted initially to alert triage and evidence summarization. It could recommend account suspension, but suspension required human approval except for narrowly defined, reversible emergency conditions. Prompts and outputs were prohibited from containing unnecessary patient information, and model use was logged.

Management reporting changed to include critical-asset coverage, multifactor authentication coverage, restoration-test success, high-risk remediation age, supplier assessment status, and incident response time. A cryptographic inventory identified systems requiring future algorithm replacement and included PQC requirements in new procurement specifications.

Outcome

The program produced clearer ownership, reduced uncontrolled supplier access, and improved the quality of management decisions. It did not eliminate risk, and the organization recognized that framework adoption and AI deployment required continuing assessment. The case demonstrates that governance connects technical controls, legal duties, safety, privacy, procurement, and strategy.

Learning points

1. A policy without ownership, evidence, and enforcement is weak governance.
2. Third-party access should be treated as an extension of the organization’s attack surface.
3. AI automation must be proportionate to confidence, reversibility, and potential harm.
4. Management metrics should describe exposure and resilience, not merely security activity.
5. Cryptographic migration requires inventory and planning before a crisis occurs.

Challenges and Limitations

Frameworks can create excessive documentation, duplicated audits, and a false sense of assurance if organizations focus on evidence production rather than outcomes. Risk scores can conceal uncertainty and interdependence. Privacy requirements may conflict across jurisdictions, particularly in global monitoring and cloud operations. AI performance can degrade when attacker behavior, data, or environments change. Automation can amplify errors at machine speed. Supply-chain transparency is often incomplete because suppliers depend on further suppliers. PQC migration may encounter legacy systems, limited device resources, certificate constraints, and interoperability problems.

These limitations do not invalidate governance. They show why governance must be adaptive, evidence-based, proportionate, and connected to operational reality. Security is a continuing process of learning and adjustment rather than a completed certification event.

Best-Practice Checklist

• Assign accountable owners for critical systems, data, suppliers, and risks.
• Maintain current asset, data-flow, dependency, and cryptographic inventories.
• Map applicable law and contractual duties with qualified legal and privacy advice.
• Use a recognized framework, but tailor controls to the organization’s risk.
• Test policies through exercises, audits, technical validation, and incident lessons.
• Control third-party access with least privilege, strong authentication, monitoring, and termination procedures.
• Report trends, exposure, resilience, uncertainty, and decisions—not only activity counts.
• Use AI with data protection, validation, human oversight, constrained authority, and auditability.
• Design automation for safe failure, reversibility, and limited blast radius.
• Begin post-quantum planning through cryptographic inventory and crypto-agility.
• Review emerging technologies critically and measure whether they reduce material risk.

Chapter Summary

Governance gives network security direction, authority, accountability, and assurance. Policies express organizational intent, standards define required levels, procedures guide execution, and records provide evidence. Laws establish external duties, while ethics guides responsible conduct where legal rules may be incomplete.

NIST CSF organizes cybersecurity outcomes through Govern, Identify, Protect, Detect, Respond, and Recover. ISO/IEC 27001 establishes requirements for a certifiable information security management system. These approaches can complement one another when applied according to scope and purpose. Privacy requires lawful, transparent, necessary, proportionate, and secure handling of personal information.

Vendor and software supply-chain risk requires due diligence, contractual controls, technical restrictions, monitoring, and exit planning. Effective managerial reporting links technical conditions to business impact, uncertainty, ownership, and decisions. AI can improve defensive analysis, but it introduces privacy, reliability, manipulation, and excessive-agency risks. Human oversight, constrained permissions, validation, and logging are essential. Attackers also use AI to scale deception and reconnaissance, making identity assurance and layered controls increasingly important.

Post-quantum readiness begins with cryptographic inventory, prioritization, crypto-agility, and standards-based migration. Finally, trends such as zero trust and confidential computing should be judged by demonstrated risk reduction rather than marketing claims. Strategic cybersecurity is therefore a continuous, ethical, and accountable organizational capability.

Key Terms

Governance: Direction, oversight, accountability, and control of organizational activities.

Risk appetite: The level and type of risk an organization is willing to accept.

Policy: An approved statement of mandatory organizational intent.

Standard: A defined technical or managerial requirement for consistent practice.

Procedure: An authorized sequence of steps for performing an activity.

Assurance: Evidence-based confidence that controls and obligations are being met.

NIST Cybersecurity Framework: A flexible framework organized around six cybersecurity functions.

ISMS: Information Security Management System used to manage information-security risks systematically.

ISO/IEC 27001: An international standard specifying requirements for an ISMS.

Privacy: Appropriate control over the collection, use, disclosure, retention, and protection of personal information.

Data minimization: Limiting data collection and retention to what is necessary.

Responsible disclosure: Coordinated reporting of vulnerabilities to reduce harm.

Supply-chain risk: Risk introduced by suppliers, dependencies, service providers, and update channels.

SBOM: Software bill of materials identifying software components and dependencies.

Human oversight: Meaningful review and control by qualified people over consequential automated decisions.

Prompt injection: Manipulation of an AI system through crafted input that conflicts with intended instructions.

Crypto-agility: Ability to replace cryptographic algorithms, keys, or protocols with limited disruption.

Post-quantum cryptography: Cryptography designed to resist attacks from known quantum-computing techniques.

Zero trust: A security approach that avoids implicit trust and continuously evaluates access.

Residual risk: Risk remaining after controls and treatments have been applied.

Review Questions

Short Answer Questions

1. Distinguish governance from security management.
2. What are the six functions of the NIST Cybersecurity Framework?
3. Why does compliance not necessarily equal security?
4. Give two examples of controls for managing supplier access.
5. What is meant by crypto-agility?

Long Answer Questions

1. Explain how policies, standards, procedures, guidelines, and records work together in a security program.
2. Compare the purposes and uses of NIST CSF and ISO/IEC 27001.
3. Discuss privacy and ethical issues arising from centralized employee-security monitoring.
4. Explain the governance controls required for responsible AI-assisted defense.
5. Describe a practical organizational approach to post-quantum readiness.

Analytical / Application Questions

1. A supplier requests permanent administrator access to a production database to support a critical application. Analyze the risks and recommend governance, contractual, and technical controls.
2. An AI system recommends disabling 500 user accounts during a suspected attack, but its confidence is uncertain. Design a safe decision and escalation process.
3. A board receives a report stating that 98% of attacks were blocked. Evaluate why this metric may be insufficient and propose a more useful reporting set.

Multiple Choice Questions with Answers

Question 1

Which NIST Cybersecurity Framework function establishes cybersecurity strategy, expectations, and policy?

A. Govern

B. Protect

C. Detect

D. Recover

Correct Answer: A. Govern

Question 2

What is the principal distinguishing feature of ISO/IEC 27001?

A. It is only a firewall configuration guide

B. It specifies requirements for an information security management system

C. It replaces all privacy laws

D. It guarantees that no breach can occur

Correct Answer: B. It specifies requirements for an information security management system

Question 3

Which practice best reflects data minimization?

A. Retaining every log forever

B. Collecting only information necessary for a defined purpose

C. Sharing all monitoring data with suppliers

D. Collecting personal data before defining its use

Correct Answer: B. Collecting only information necessary for a defined purpose

Question 4

Which control most directly reduces risk from permanent vendor administrator access?

A. Publicly publishing administrator usernames

B. Time-limited named accounts with multifactor authentication and logging

C. Removing all audit records

D. Using one shared password for convenience

Correct Answer: B. Time-limited named accounts with multifactor authentication and logging

Question 5

Why should an AI security assistant normally require human approval before disabling many accounts?

A. AI systems cannot process any data

B. Account disabling may have a large operational impact and the model may be wrong

C. Human approval makes encryption unnecessary

D. Automation is always prohibited in cybersecurity

Correct Answer: B. Account disabling may have a large operational impact and the model may be wrong

Question 6

What is prompt injection?

A. Physical damage to a server

B. Manipulation of an AI system through crafted input that conflicts with intended instructions

C. A method of compressing network traffic

D. A certificate renewal process

Correct Answer: B. Manipulation of an AI system through crafted input that conflicts with intended instructions

Question 7

Which statement best describes post-quantum readiness?

A. Immediately replacing every algorithm without inventory or testing

B. Inventorying cryptographic dependencies and planning standards-based migration

C. Stopping all use of symmetric cryptography

D. Assuming quantum threats are impossible

Correct Answer: B. Inventorying cryptographic dependencies and planning standards-based migration

Question 8

A risk score calculated as R = L × I is best understood as what?

A. A universal probability of financial loss

B. A qualitative or ordinal prioritization aid based on defined likelihood and impact scales

C. A legally required accounting identity

D. A proof that a control is effective

Correct Answer: B. A qualitative or ordinal prioritization aid based on defined likelihood and impact scales

Question 9

Which statement about an SBOM is correct?

A. It proves every software component is secure

B. It identifies software components and dependencies to improve visibility

C. It eliminates the need for vulnerability management

D. It is used only for physical hardware inventories

Correct Answer: B. It identifies software components and dependencies to improve visibility

Question 10

Which principle is central to zero-trust security?

A. Trust every device inside the corporate network

B. Treat network location as sufficient evidence of trust

C. Explicitly verify access and apply least privilege

D. Disable identity-based access controls

Correct Answer: C. Explicitly verify access and apply least privilege