A security architect is adopting a new security model that assumes breach and verifies every access request. The model eliminates implicit trust and requires continuous validation. Which security model is being implemented?

Defense in Depth

This model layers multiple security controls but does not specifically require continuous verification of every request. It assumes multiple layers of defense.

Least Privilege

This principle grants only the minimum permissions needed, but it is a component of security models, not the overarching model described.

Shared Responsibility

This is a model defining responsibilities between cloud provider and customer, not the authentication/access validation model described.

What does this SC-900 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Zero Trust — Zero Trust is a security model that assumes breach and requires verification for every access request, eliminating implicit trust. Defense in Depth uses multiple layers but not necessarily continuous verification. Least Privilege is a principle, not a model. Shared Responsibility relates to cloud security division.

What should I do if I get this SC-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.