Zero Trust Security Model: Never Trust, Always Verify
An organization adopts a security model that requires explicit verification of every access request, uses least privilege principles, and assumes that a breach has already occurred. Which security model does this describe?
Quick Answer
The answer is the Zero Trust security model. This is correct because Zero Trust is built on the core principles of explicit verification, least privilege access, and the assumption of breach, meaning no user, device, or network is trusted by default—every access request must be continuously validated regardless of its origin. On the Microsoft SC-900 exam, this concept tests your understanding of how Zero Trust shifts security from a traditional perimeter-based approach to a "never trust, always verify" mindset, often appearing in scenario-based questions that contrast it with legacy models. A common trap is confusing Zero Trust with a simple VPN or firewall, but remember that Zero Trust requires micro-segmentation and continuous authentication, not just a single checkpoint. Memory tip: think of the three pillars—Verify explicitly, use least privilege, and assume breach—to quickly identify Zero Trust in any exam scenario.
⚠ Common exam trap
It's easy for candidates to confuse 'defense in depth' with Zero Trust because both involve multiple security layers, but defense in depth does not require explicit verification of every request or the assumption of breach, which are unique to Zero Trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Zero Trust
Zero Trust is the correct answer because the model explicitly requires verification of every access request, enforces least privilege, and assumes breach. This aligns with the core Zero Trust principles of 'never trust, always verify,' continuous validation, and micro-segmentation, as opposed to traditional perimeter-based models that implicitly trust internal traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perimeter-based security
Why it's wrong here
Perimeter-based security focuses on defending the network boundary and trusts users inside the network, contrary to assuming breach.
- ✗
Defense in depth
Why it's wrong here
Defense in depth uses multiple layers of security controls but does not inherently require explicit verification or assume breach.
- ✓
Zero Trust
Why this is correct
Zero Trust explicitly verifies every access, enforces least privilege, and assumes breach, matching the description.
- ✗
Shared responsibility
Why it's wrong here
Shared responsibility is a cloud security model that delineates security obligations between the provider and customer, not a general security model.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization adopts a security model where they never trust a request by default, even if it comes from inside the corporate network. Every access request must be authenticated, authorized, and encrypted. They also assume that a breach will happen and design their systems to minimize the blast radius. Which security model does this describe?
easy- A.Defense in depth
- B.Shared responsibility model
- ✓ C.Zero Trust
- D.Perimeter-based security
Why C: This describes Zero Trust: never trust any request by default, even from inside the network; always authenticate, authorize, and encrypt; assume breach and limit blast radius. Defense in depth adds layers but does not require distrusting internal traffic by default. Shared responsibility assigns security duties between cloud provider and customer. Perimeter-based security typically trusts internal traffic.
Variation 2. An organization adopts a Zero Trust security model. Which principle requires that every access request must be explicitly verified and granted least privilege regardless of the user's location or device?
easy- ✓ A.Verify explicitly
- B.Use least privilege access
- C.Assume breach
- D.Never trust, always verify
Why A: The Zero Trust principle 'Verify explicitly' mandates that every access request—regardless of the user's location, device, or network—must be authenticated and authorized based on all available data points (e.g., user identity, device health, location, and real-time risk signals). This ensures that no implicit trust is granted, and least privilege is applied as a separate but complementary principle. In Microsoft's Zero Trust model, this is enforced through conditional access policies and continuous evaluation of session risk.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.