hardMultiple Select
MD-102 Practice Question: Is planning to implement a zero-trust security…
An organization is planning to implement a zero-trust security model. They need to evaluate the following capabilities in Microsoft 365. Which THREE are essential for a zero-trust architecture? (Choose three.)
⚠ Common exam trap
Many exam-takers confuse infrastructure components (like Microsoft Entra Connect sync or Application Proxy) with security controls, mistakenly thinking they are required for zero trust when they are merely supporting services for hybrid identity or remote access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Multi-factor authentication (MFA)
Multi-factor authentication (MFA) (B) is essential because zero trust requires strong, verified identity for every access request, and MFA ensures a user's identity is validated with more than a single factor before granting access to Microsoft 365 resources. Device compliance policies (D) are essential because zero trust assumes no implicit trust based on network location, so access must be gated on the health and compliance state of the endpoint (for example, via Intune compliance policies evaluated by Conditional Access). Conditional Access policies (E) are essential because they are the policy engine that ties signals such as user identity, MFA status, device compliance, location, and risk together to enforce least-privilege, adaptive access decisions in Microsoft 365. Microsoft Entra application proxy (A) is not one of the three required capabilities here; it is a remote-access/publishing solution for on-premises web apps and, while useful, is not a core zero-trust pillar in this scenario. Microsoft Entra Connect sync (C) is also not required; it is a directory synchronization tool for hybrid identity and does not itself enforce zero-trust verification or access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra application proxy
Why it's wrong here
Application Proxy publishes on-premises web apps for remote access, but zero-trust verification depends on Conditional Access evaluating signals at each request, which proxy publishing alone does not enforce. It is tempting because it does support remote access, yet it is the correct choice for exposing internal apps without a VPN.
- ✓
Multi-factor authentication (MFA)
Why this is correct
MFA directly enforces zero trust's verify-explicitly principle by requiring a second authentication factor, so a compromised password alone cannot grant access. It satisfies the stem's demand for identity verification at every sign-in, blocking credential-based lateral movement and satisfying conditional access policies that Microsoft Entra ID evaluates per session.
- ✗
Microsoft Entra Connect sync
Why it's wrong here
Directory synchronisation populates identities into Microsoft Entra ID; zero-trust decisions require Conditional Access policies evaluating per-request signals, which sync itself does not perform. It is tempting because hybrid identity underpins many deployments, and it would be correct when the requirement is synchronising on-premises accounts to the cloud.
- ✓
Device compliance policies
Why this is correct
Device compliance policies enforce conditional access by verifying health signals—encryption, OS version, threat protection—before granting resource access. This satisfies zero-trust's "verify explicitly" principle, ensuring only compliant devices reach Microsoft 365 data, regardless of network location.
- ✓
Conditional Access policies
Why this is correct
Conditional Access policies satisfy zero-trust's explicit verification requirement by evaluating signals—user identity, device compliance, location and risk—at authentication time, then enforcing grant controls such as multifactor authentication or compliant-device access. This dynamic, per-session enforcement replaces implicit network trust, directly meeting the stem's demand for continuous, context-aware access decisions in Microsoft Entra ID.
Go deeper
Related to this question
Learn chapter
Implementing App Protection Policies (MAM)
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Security model
A security model is a formal framework that defines how subjects (users, processes) can access objects (files, resources) based on rules, ensuring confidentiality, integrity, and availability.
About these practice questions
This MD-102 question is part of Courseiva's 556-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.