SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company's security team configures network firewall rules so that only a dedicated jump server's IP address can initiate RDP connections to production servers. This is an example of which security principle?
⚠ Common exam trap
It's easy for candidates to confuse 'least privilege' (limiting access to what is necessary) with 'defense in depth' (multiple layers), because both involve restricting access, but least privilege focuses on the minimal permissions while defense in depth focuses on layered controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
Restricting RDP access to only a dedicated jump server's IP address ensures that no other hosts or users can directly initiate remote desktop connections to production servers. This enforces the principle of least privilege by granting only the minimum necessary network access (the jump server) required for administrative tasks, reducing the attack surface and limiting lateral movement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Least privilege
Why this is correct
The principle of least privilege dictates that users and systems should only be granted the minimum necessary permissions to perform their legitimate functions. By configuring firewall rules to restrict Remote Desktop Protocol (RDP) access exclusively to a hardened jump server, the security team ensures that direct administrative access to sensitive internal resources is severely limited. This prevents unauthorized lateral movement and reduces the attack surface, aligning precisely with the goal of minimizing potential harm from compromised credentials or systems.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a security strategy that employs multiple, overlapping security controls to protect assets, so if one control fails, another is in place to provide protection. While a firewall rule is a security control, this scenario describes a single configuration change (restricting RDP to a jump server) rather than the implementation of multiple, distinct layers of security. For it to be defense in depth, the scenario would need to describe additional, complementary controls like endpoint detection, multi-factor authentication, or network segmentation beyond just the RDP restriction.
- ✗
Zero Trust
Why it's wrong here
The Zero Trust security model operates on the principle of "never trust, always verify," requiring strict identity verification for every user and device attempting to access resources, regardless of their location. While restricting RDP access to a jump server enhances security by limiting direct access, this specific action alone does not encompass the continuous verification, micro-segmentation, and comprehensive identity and access management that define a full Zero Trust architecture. It's a component that supports Zero Trust but isn't the overarching strategy itself.
- ✗
Separation of duties
Why it's wrong here
Separation of duties is a control designed to prevent fraud, errors, and abuse by ensuring that no single individual can complete a critical or sensitive task from start to finish without oversight. This principle involves dividing responsibilities for a process among multiple people, such as requiring one administrator to approve a change that another administrator initiates. The scenario, which focuses on restricting network access paths for RDP, does not describe the division of administrative roles or tasks among different individuals.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.