SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Explicitly verify every access request

  Why this is correct

  This is a core principle of Zero Trust, mandating that no access is granted based on implicit trust derived from network location or previous authentication. Every single request for a resource must be rigorously authenticated and authorized. This process involves evaluating multiple data points, including user identity, device health, location, and the sensitivity of the resource being accessed, to ensure least privilege access is consistently applied.

• ✓

  Assume that everything is on an open network

  Why this is correct

  This principle, often encapsulated by "assume breach," dictates that the network perimeter is no longer a sufficient security boundary. Instead, all network traffic, irrespective of its origin—whether internal or external—is treated as potentially malicious and untrusted. This necessitates that every connection and access attempt must be inspected, authenticated, and authorized before access to any resource is granted, effectively eliminating the concept of a "trusted" internal network zone.

• ✗

  Rely on a single perimeter firewall

  Why it's wrong here

  Traditional security models heavily depend on a strong, singular network perimeter, often secured by a single firewall, to protect internal assets. However, Zero Trust architecture fundamentally rejects this reliance, recognizing that attackers can bypass or breach such a perimeter. It advocates for a distributed security model utilizing micro-segmentation and numerous enforcement points, rendering a single perimeter firewall insufficient and largely obsolete as the primary defense mechanism.

• ✗

  Trust internal traffic implicitly

  Why it's wrong here

  A foundational tenet of Zero Trust is "never trust, always verify," which directly contradicts the notion of implicitly trusting internal network traffic. Legacy security models often mistakenly assume that traffic originating from inside the corporate network is inherently safe. Zero Trust, however, mandates that all internal traffic, just like external traffic, must be authenticated, authorized, and continuously monitored, thereby preventing lateral movement by an attacker who has gained initial access within the network.

• ✗

  Assume that the network is always safe

  Why it's wrong here

  Zero Trust operates under the explicit and critical assumption that the network environment is never inherently safe and that a breach is either inevitable or has already occurred. This "assume breach" mentality drives the imperative for continuous verification and the application of least privilege access for every single request, rather than relying on the false premise of a secure network infrastructure. It mandates proactive, adaptive security measures, not reactive ones based on a perceived safe state.

Go deeper

Related to this question