SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your company is implementing a zero-trust security model. Which principle requires verifying every access request as though it originates from an untrusted network, even if the request comes from within the corporate network?
⚠ Common exam trap
SC-900 often tests the confusion between the three Zero Trust principles, tricking candidates into selecting 'assume breach' or 'least privilege' when the question specifically describes verifying every request regardless of network origin.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Explicit verification
Explicit verification is one of the three core Zero Trust principles (alongside least privilege and assume breach) and specifically requires authenticating and authorizing every access request based on all available data points — identity, location, device health, service, and workload — regardless of whether the request originates inside or outside the corporate network. It rejects the traditional 'trusted internal network' assumption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Least privilege
Why it's wrong here
Least privilege limits the permissions granted to identities, addressing authorisation scope rather than the continuous verification of every access request regardless of network origin. It would be the right principle when restricting what an authenticated user or service can do, not when deciding that no request is trusted based on network location.
- ✗
Trust but verify
Why it's wrong here
Zero-trust's verify-explicitly principle demands authentication and authorisation on every request, with no implicit trust from network location. 'Trust but verify' assumes an internal network is already trusted, so it never re-evaluates requests originating inside the perimeter. It suits legacy perimeter models, not zero trust.
- ✓
Explicit verification
Why this is correct
Explicit verification authenticates and authorises every access request using all available signals, regardless of network origin. This directly satisfies the zero-trust requirement to treat internal requests as untrusted, rather than granting implicit trust based on corporate network location.
- ✗
Assume breach
Why it's wrong here
Assume breach minimises blast radius and segments access, assuming compromise has already occurred; it does not itself verify every request. It is tempting because it shares zero trust's sceptical posture, and it is the right principle when designing containment and lateral-movement limits.
Go deeper
Related to this question
Learn chapter
Azure NSG and Application Security Groups
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
Security model
A security model is a formal framework that defines how subjects (users, processes) can access objects (files, resources) based on rules, ensuring confidentiality, integrity, and availability.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.