SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Which THREE of the following are components of the Zero Trust security model?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use least privilege access
The three core principles of Zero Trust are: verify explicitly, use least privilege access, and assume breach. Network perimeter security is a traditional model, not Zero Trust. Single sign-on is a convenience feature, not a core principle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use least privilege access
Why this is correct
The "Use least privilege access" principle dictates that users and devices should only be granted the minimum necessary permissions to perform their specific tasks, for the shortest possible duration. This is often implemented through Just-In-Time (JIT) and Just-Enough-Access (JEA) mechanisms, significantly reducing the potential blast radius and impact should an account or system become compromised. It ensures that even if an attacker gains access, their lateral movement and damage are severely limited.
- ✗
Single sign-on (SSO)
Why it's wrong here
Single sign-on (SSO) is a valuable identity management feature that streamlines user authentication by allowing access to multiple applications with one set of credentials. However, SSO itself is not a core Zero Trust principle; it primarily enhances user experience and can improve security by reducing password fatigue. Zero Trust demands continuous, explicit verification and granular authorization for every access request, which goes beyond the initial authentication facilitated by SSO.
- ✗
Network perimeter security
Why it's wrong here
Network perimeter security, which relies on a strong boundary to protect an assumed-trusted internal network, is fundamentally at odds with Zero Trust principles. Zero Trust explicitly rejects the concept of a trusted network segment, treating all network traffic and access requests, whether originating internally or externally, as untrusted. It mandates explicit verification for every access attempt, regardless of its network origin, thereby eliminating reliance on a traditional perimeter.
- ✓
Assume breach
Why this is correct
The "Assume breach" principle mandates that organizations design their security architecture with the expectation that a breach will eventually occur, rather than trying to prevent all intrusions. This proactive mindset leads to strategies like micro-segmentation, robust monitoring, and rapid incident response capabilities to contain and mitigate potential compromises quickly. It focuses on minimizing the blast radius and ensuring business continuity even in the face of a successful attack.
- ✓
Verify explicitly
Why this is correct
The "Verify explicitly" principle requires that all access requests are authenticated and authorized based on all available data points, rather than relying on implicit trust. This comprehensive verification process incorporates user identity, device health, location, service, data sensitivity, and behavioral anomalies. It ensures that trust is never assumed but is continuously and dynamically evaluated before granting access to any resource, regardless of where the request originates.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security model
A security model is a formal framework that defines how subjects (users, processes) can access objects (files, resources) based on rules, ensuring confidentiality, integrity, and availability.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are core principles of the Zero Trust security model? (Choose three.)
hard- ✓ A.Verify explicitly
- B.Trust but verify
- ✓ C.Assume breach
- ✓ D.Least privilege
- E.Single factor authentication
Why A: Zero Trust principles include 'Verify explicitly', 'Least privilege', and 'Assume breach'. 'Trust but verify' is a traditional perimeter-based model. 'Single factor' contradicts explicit verification.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.