SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A security architect is designing a Zero Trust strategy. Which principle ensures that network location alone does not grant trust, and all access requests must be verified?
⚠ Common exam trap
It's easy for candidates to confuse 'Least privilege' with 'Verify explicitly' because both involve access control, but 'Least privilege' is about limiting permissions after trust is established, not about verifying trust based on network location.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify explicitly
The 'Verify explicitly' principle is the core of Zero Trust, stating that every access request must be authenticated and authorized based on all available data points—including user identity, device health, location, and data sensitivity—regardless of network location. This ensures that being on a corporate network does not automatically grant trust, as all requests are verified in real time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify explicitly
Why this is correct
Correct. Verify Explicitly is the Zero Trust principle that requires continuous verification of every access request regardless of network location. It ensures that no implicit trust is granted based on being inside the corporate network.
- ✗
Least privilege
Why it's wrong here
Least privilege is a fundamental security principle that dictates users and systems should only be granted the minimum necessary access rights to perform their required tasks. While crucial for reducing the attack surface and limiting potential damage, it primarily concerns *what* resources can be accessed after authentication. It does not directly address the continuous, explicit *verification* of *who* is accessing resources and from *where* at the moment of access, which is central to Zero Trust's "Verify explicitly" principle.
- ✗
Assume breach
Why it's wrong here
The "Assume Breach" principle in Zero Trust acknowledges that breaches are inevitable and requires organizations to design their security architecture with the expectation that attackers may already be present within the network. This leads to strategies like micro-segmentation, robust incident response, and threat hunting, focusing on limiting the blast radius and detecting threats quickly. It is about resilience and mitigation post-compromise, rather than the initial, continuous verification of every access request.
- ✗
Segregation of duties
Why it's wrong here
Segregation of duties (SoD) is an internal control mechanism designed to prevent fraud and errors by ensuring that no single individual has complete control over a critical process. It involves dividing responsibilities among different people to prevent conflicts of interest or malicious actions, such as requiring separate individuals to initiate, approve, and record a transaction. While a vital governance and compliance control, SoD is a procedural and organizational principle, distinct from the technical, continuous verification tenets of a Zero Trust architecture.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Verify explicitly
Verify explicitly means that a system must actively confirm a user's identity or permissions before granting access, rather than trusting implied or cached credentials.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.