SC-100 Practice Question: Design solutions that align with security best practices and priorities
A company plans to implement a Zero Trust security model. Which of the following is the primary principle that should guide their strategy?
⚠ Common exam trap
Watch out — candidates often confuse 'trust but verify' (Option D) with Zero Trust, but Zero Trust explicitly rejects any pre-established trust and requires verification at every access attempt, making 'assume breach and verify explicitly' the correct guiding principle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assume breach and verify explicitly
The primary principle of Zero Trust is 'never trust, always verify,' which is operationalized as 'assume breach and verify explicitly.' This means every access request—regardless of source (internal or external)—must be authenticated, authorized, and encrypted before granting access. It eliminates implicit trust based on network location and enforces least-privilege access, which is foundational to the Zero Trust architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assume breach and verify explicitly
Why this is correct
Zero Trust rejects implicit trust from network location; every request is authenticated and authorised against policy using identity, device and context signals. Assuming breach drives least-privilege access and continuous verification, which is the guiding principle the strategy requires.
- ✗
Use a strong perimeter firewall as the primary defense
Why it's wrong here
Zero Trust assumes breach and verifies every request explicitly, so a perimeter firewall alone leaves internal lateral movement unchecked. It is tempting because perimeter defence remains valid for blocking external intrusion at network boundaries, but it cannot satisfy the verify-explicitly, least-privilege principles the scenario demands.
- ✗
Grant trusted users full access to all resources
Why it's wrong here
Zero Trust grants least-privilege, just-in-time access scoped to the resource and verified per session; blanket access for trusted users contradicts that. The option is tempting because it resembles legacy perimeter thinking, where internal identity alone justified broad rights. It would fit no Zero Trust scenario.
- ✗
Trust but verify all internal traffic
Why it's wrong here
'Trust but verify' still begins from implicit trust in internal traffic, whereas Zero Trust assumes breach and verifies every request explicitly regardless of network location. It is tempting because verification sounds rigorous. Continuous evaluation of identity, device and context would be correct where no network zone is inherently trusted.
Go deeper
Related to this question
Learn chapter
Designing IoT and Operational Technology Security Architecture
Key term
Microsoft 365 Security Design
Microsoft 365 Security Design is the process of planning and configuring built-in security features in Microsoft 365 to protect data, identities, and devices from cyber threats.
Key term
Zero Trust Strategy
A security model that requires continuous verification of every user, device, and connection before granting access to any resource, regardless of where the request originates.
About these practice questions
One of 605 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.