SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Verify explicitly

  Why this is correct

  "Verify explicitly" is a foundational principle of Zero Trust, mandating that all access requests, regardless of origin, must be thoroughly authenticated and authorized before granting access. This involves evaluating multiple dynamic data points, including user identity, device health, service or workload, data classification, location, and detected anomalies, to make an informed, real-time access decision. It fundamentally shifts security from perimeter-based trust to continuous, granular validation, never implicitly trusting anything inside or outside the network.

• ✗

  Use least privilege access

  Why it's wrong here

  While an essential component of a robust security posture and often implemented within a Zero Trust framework, "Use least privilege access" is a distinct principle focused on minimizing the scope of permissions granted to users and systems. It ensures that entities only have the necessary access for their specific tasks and for the shortest possible duration (just-in-time, just-enough access), rather than defining the continuous verification process itself. This principle primarily helps limit the potential blast radius in case of a compromise.

• ✗

  Assume breach

  Why it's wrong here

  "Assume breach" is a foundational mindset for Zero Trust, dictating that organizations should design their security architecture and operations as if an attacker has already gained access to the network. This principle drives strategies like micro-segmentation, robust monitoring, and incident response planning to contain and mitigate potential threats quickly and minimize damage. However, it describes a strategic posture and risk management approach, not one of the three core operational principles directly governing the continuous verification and authorization of access requests.

• ✗

  Enforce session controls

  Why it's wrong here

  Enforcing session controls, such as requiring reauthentication for sensitive actions, limiting session duration, or monitoring session activity, is a valuable security mechanism often deployed as part of a comprehensive Zero Trust implementation. These controls help maintain security post-authentication by continuously evaluating user and device behavior during an active session and adjusting access accordingly. However, it represents a specific technical control or capability rather than one of the overarching, foundational principles of Zero Trust, which are "Verify explicitly," "Use least privilege access," and "Assume breach."