SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A security architect is explaining the evolution of the security perimeter. They state that because users access corporate resources from anywhere on any device, the traditional network perimeter is no longer sufficient. What does the architect identify as the new primary security perimeter?
⚠ Common exam trap
Test-takers frequently confuse the endpoint (the device) with identity, but the endpoint is merely a vector for identity claims—without identity as the authoritative control point, device-based security alone cannot prevent unauthorized access from a different user on the same device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The identity
In modern zero-trust architectures, identity is the new primary security perimeter because it enables granular access control regardless of network location. Since users access corporate resources from anywhere on any device, authentication and authorization (via protocols like OAuth 2.0, SAML, and OpenID Connect) become the decisive factor for granting access, rather than the traditional network boundary. This shift is foundational to Microsoft's identity-centric security model, where Azure AD (now Microsoft Entra ID) acts as the control plane for all resource access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The cloud infrastructure
Why it's wrong here
Cloud infrastructure provides the underlying compute, storage, and networking resources where applications and data reside. While it offers inherent security features like network segmentation and physical security, it does not inherently control who accesses the resources *within* it. Access decisions are primarily governed by identity and access management (IAM) systems, which authenticate users and authorize their requests, making the infrastructure a secured environment rather than the primary security boundary.
- ✗
The data center
Why it's wrong here
Historically, the data center served as the primary security perimeter, with firewalls and network devices protecting resources within its physical and logical boundaries. However, the rise of remote work, mobile devices, and cloud computing has rendered this traditional perimeter insufficient. Resources and users are now distributed beyond the data center's confines, necessitating a security model that protects access regardless of location, rather than relying solely on network-based controls.
- ✓
The identity
Why this is correct
Identity has emerged as the new security perimeter in modern architectures, particularly with the adoption of Zero Trust principles. It serves as the control plane for all access decisions, authenticating every user and device, and authorizing their access requests to resources regardless of their network location or the device they are using. This approach ensures that access is granted only after verifying the identity and context, making it the most critical security boundary.
- ✗
The endpoint
Why it's wrong here
Endpoints, such as laptops, smartphones, and servers, are crucial components of the overall security posture as they are often the initial point of interaction for users and data. While securing endpoints with anti-malware, firewalls, and compliance policies is vital, they are not the security perimeter itself. Endpoint security is typically enforced through policies managed by identity and access management systems, which dictate what an authenticated identity can do from a compliant device, making identity the overarching control.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
OpenID Connect
OpenID Connect is an identity layer on top of OAuth 2.0 that allows applications to verify a user's identity and obtain basic profile information in a standardized way.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.