Explain Zero Trust Network Architecture (ZTNA) and how it differs from VPN.

Traditional VPN — 'castle and moat' model. User authenticates once, gets full network access. Once breached, attacker has network-wide access. ZTNA — 'never trust, always verify'. Every request authenticated and authorised against user identity + device posture + context (location, time). User connects to specific applications, not the network. Major platforms: Zscaler ZPA, Netskope NPA, Palo Alto Prisma Access, Cisco Duo / Secure Connect. Hiring growth for ZTNA engineers is 35% YoY in 2026.