SC-900 Practice Question: Describe the concepts of security, compliance, and identity
An organization is redesigning its security architecture based on the Zero Trust model. Which principle requires that every access request must be fully authenticated, authorized, and encrypted before granting access, regardless of the network location?
⚠ Common exam trap
Microsoft often tests the distinction between 'verify explicitly' and 'trust but verify', where candidates mistakenly choose 'trust but verify' because it sounds like a security principle, but the Zero Trust model explicitly rejects any form of implicit trust, requiring verification for every request regardless of network location.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify explicitly
The Zero Trust model is built on three core principles: verify explicitly, least privilege, and assume breach. The principle that mandates every access request—regardless of whether it originates from inside or outside the corporate network—must be fully authenticated, authorized, and encrypted before granting access is 'verify explicitly'. This means using strong authentication methods (e.g., multifactor authentication), continuous validation of authorization (e.g., Conditional Access policies), and enforcing encryption (e.g., TLS 1.3) for every request, not just those from untrusted locations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assume breach
Why it's wrong here
The 'Assume breach' principle dictates that organizations should operate under the mindset that an attacker has already successfully penetrated their defenses. This strategy emphasizes detection, containment, and rapid response to limit lateral movement and mitigate damage, rather than preventing initial access. While a vital component of a comprehensive security posture, it does not directly address the continuous, explicit authentication and authorization required for every access attempt, which is central to Zero Trust.
- ✗
Least privilege
Why it's wrong here
Least privilege is a foundational security concept focused on restricting user and system access rights to the absolute minimum necessary to perform their legitimate functions. While crucial for minimizing potential damage by limiting what an authenticated entity can do, it primarily governs permissions after authentication. It does not dictate the continuous, explicit authentication and authorization of every individual access request, which is the core tenet of Zero Trust's 'Verify explicitly' principle.
- ✓
Verify explicitly
Why this is correct
The 'Verify explicitly' principle is a cornerstone of the Zero Trust model, mandating that every access request to any resource must be fully authenticated, authorized, and validated based on all available contextual signals. This includes user identity, device health, location, service, and data classification, ensuring no implicit trust is ever granted. It requires continuous, real-time evaluation before granting access, regardless of whether the request originates inside or outside the traditional network perimeter.
- ✗
Trust but verify
Why it's wrong here
'Trust but verify' implies an initial, albeit conditional, level of trust that is subsequently checked or audited. This concept fundamentally contradicts the Zero Trust model, which explicitly rejects all forms of implicit trust based on network location or prior authentication. Zero Trust demands continuous, explicit verification for every access attempt, meaning trust is never assumed, only granted dynamically and temporarily after rigorous validation.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Multifactor Authentication
Multifactor Authentication (MFA) is a security method that requires you to provide two or more pieces of evidence to prove your identity before accessing an account or system.
Key term
Assume breach
Assume breach is a security mindset where an organization operates as if attackers have already compromised their network, shifting focus to rapid detection, containment, and damage limitation rather than only prevention.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.