SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Which THREE of the following are core principles of the Zero Trust security model? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify explicitly
Zero Trust principles include 'Verify explicitly', 'Least privilege', and 'Assume breach'. 'Trust but verify' is a traditional perimeter-based model. 'Single factor' contradicts explicit verification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify explicitly
Why this is correct
This principle mandates that all access requests, regardless of origin or resource, must be authenticated and authorized rigorously. It involves continuously evaluating user identity, device health, location, and other contextual signals before granting or maintaining access. This explicit verification ensures that no entity is inherently trusted and access is always granted based on real-time policy enforcement.
- ✗
Trust but verify
Why it's wrong here
The "trust but verify" approach is characteristic of traditional perimeter-based security models, where entities inside the network are implicitly trusted once they've passed an initial verification at the network edge. In contrast, Zero Trust fundamentally rejects this concept, asserting that trust should never be assumed, even for internal users or devices. This traditional model often leads to lateral movement vulnerabilities if an attacker breaches the perimeter.
- ✓
Assume breach
Why this is correct
This core principle dictates that organizations must operate under the assumption that their network has already been compromised or will be at some point. Consequently, security architectures are designed to minimize the "blast radius" of any potential breach by segmenting networks, isolating resources, and implementing granular access controls. This proactive mindset shifts focus from prevention alone to detection, response, and containment.
- ✓
Least privilege
Why this is correct
The principle of least privilege ensures that users and devices are granted only the minimum necessary access to perform their specific tasks, and for the shortest possible duration. This involves implementing just-in-time (JIT) and just-enough-access (JEA) permissions, significantly reducing the potential impact if an account or device is compromised. It prevents over-privileged accounts from being exploited for unauthorized lateral movement or data exfiltration.
- ✗
Single factor authentication
Why it's wrong here
Single-factor authentication (SFA) relies on only one piece of evidence, such as a password, to verify an identity, making it highly susceptible to phishing, brute-force attacks, and credential stuffing. Zero Trust explicitly mandates the use of strong multi-factor authentication (MFA) for all access requests, significantly enhancing identity verification by requiring two or more distinct authentication factors. SFA is fundamentally incompatible with the rigorous verification demands of a Zero Trust architecture.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Assume breach
Assume breach is a security mindset where an organization operates as if attackers have already compromised their network, shifting focus to rapid detection, containment, and damage limitation rather than only prevention.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.