Zero Trust Network Architecture with Microsoft Entra Internet Access: Key Components
Which THREE components are required to implement a Zero Trust network architecture using Microsoft Entra Internet Access (formerly Microsoft 365 Network Connectivity)?
Quick Answer
The answer is Microsoft Entra Internet Access, Conditional Access, and Intune compliance. These three components form the foundation of a Zero Trust network architecture because they enforce the core principle of "never trust, always verify" at the identity, device, and network layers. Entra Internet Access acts as a secure internet breakout, replacing traditional VPNs by applying granular access policies directly to cloud traffic, while Conditional Access evaluates user and session risk in real time, and Intune compliance ensures only healthy, policy-adherent devices can connect. On the Microsoft Cybersecurity Architect exam, this question tests your ability to distinguish between modern Zero Trust controls and legacy perimeter solutions—a common trap is selecting VPN or Azure AD Application Proxy, which are outdated for this architecture. Remember the mnemonic "ICE": Internet Access, Conditional Access, and Endpoint compliance (Intune) are the three pillars that melt the old perimeter model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policies
Options A, D, and E are correct. Conditional Access policies enforce access controls based on user, device, and location signals. Microsoft Intune device compliance policies ensure devices meet security requirements before access. Microsoft Entra Internet Access (formerly Microsoft Global Secure Access) is the core Zero Trust network gateway, providing secure internet and SaaS access. Option B (Azure AD Application Proxy, now Entra Application Proxy) is incorrect because it is designed for publishing legacy on-premises apps, not as a core component of Zero Trust network architecture. Option C (Site-to-site VPN) is incorrect as it represents traditional perimeter-based network access, which Zero Trust aims to replace.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conditional Access policies
Why this is correct
Conditional Access policies enforce real-time access decisions based on user, device, location, and risk signals before granting connectivity through Microsoft Entra Internet Access. This satisfies the stem’s requirement for a Zero Trust component by implementing the “explicitly verify” principle—each session is evaluated against policy rather than relying on implicit network trust.
- ✗
Azure AD Application Proxy
Why it's wrong here
Application Proxy is for remote access to on-premises apps, not a Zero Trust component for internet access.
- ✗
Site-to-site VPN
Why it's wrong here
VPN is a legacy perimeter technology, not Zero Trust.
- ✓
Microsoft Intune device compliance policies
Why this is correct
Ensures devices meet security requirements before access.
- ✓
Microsoft Entra Internet Access (Microsoft Global Secure Access)
Why this is correct
Provides secure internet access with traffic forwarding.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE components are required to implement a zero-trust network architecture in Azure using Microsoft security solutions?
hard- A.Microsoft Sentinel
- B.Azure Bastion
- ✓ C.Microsoft Defender for Cloud Apps
- ✓ D.Microsoft Entra ID Conditional Access
- ✓ E.Azure Policy
Why C: Azure AD Conditional Access enforces access policies. Microsoft Defender for Cloud Apps provides cloud access security broker (CASB) functionality. Azure Policy ensures compliance. Azure Bastion is for secure connectivity. Microsoft Sentinel is for SIEM, not a core zero-trust component.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.