SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company's security team has adopted a strategy that assumes a breach has already occurred. They implement network segmentation, apply strict least privilege access, continuously verify all access requests, and never trust users or devices solely because they are inside the network perimeter. This approach best describes which security model?
⚠ Common exam trap
Candidates often confuse 'Defense in depth' with Zero Trust because both involve multiple security controls, but Defense in depth does not require the 'assume breach' mindset or the elimination of implicit trust based on network perimeter, which is the defining characteristic of Zero Trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Zero Trust
The scenario explicitly describes the core tenets of the Zero Trust model: assume breach, enforce least privilege, segment networks, and never trust any user or device based solely on network location. Zero Trust, as defined by NIST SP 800-207, mandates continuous verification of every access request, treating every request as if it originates from an untrusted network, which directly matches the company's strategy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Zero Trust
Why this is correct
Zero Trust is a strategic security model predicated on the principle of "never trust, always verify." It fundamentally assumes that a breach is inevitable or has already occurred, requiring explicit verification for every access request, regardless of origin or prior authorization. This model mandates continuous validation of identity, device health, and service context, while enforcing least privilege access to minimize potential damage from successful intrusions.
- ✗
Shared responsibility model
Why it's wrong here
The shared responsibility model delineates the specific security obligations between a cloud service provider (CSP) and its customers. While crucial for understanding operational boundaries in cloud environments, this model primarily addresses *who* is responsible for different security aspects (e.g., physical security vs. data classification). It does not, however, prescribe a proactive security posture like "assume breach" or dictate continuous verification for every interaction, which are core tenets of the strategy described.
- ✗
Defense in depth
Why it's wrong here
Defense in depth uses multiple layers of security controls (e.g., firewall, antivirus, access control) to protect assets. While it is a sound strategy, it does not explicitly incorporate the 'assume breach' and 'continuous verification' pillars of Zero Trust.
- ✗
Identity and Access Management (IAM)
Why it's wrong here
Identity and Access Management (IAM) encompasses the policies, processes, and technologies used to manage digital identities and control user access to resources. IAM systems authenticate users and authorize their access based on defined roles and permissions, ensuring the right individuals have appropriate access. While IAM is a critical foundational component and enabler for many security strategies, including Zero Trust, it is not itself the comprehensive security model that dictates an "assume breach" mindset or continuous validation across all digital interactions.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security model
A security model is a formal framework that defines how subjects (users, processes) can access objects (files, resources) based on rules, ensuring confidentiality, integrity, and availability.
Key term
Network segmentation
Network segmentation is the practice of dividing a computer network into smaller, isolated parts to improve performance, contain security threats, and simplify management.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.