SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Assume breach

  Why this is correct

  The "Assume breach" principle dictates that organizations should design their security architecture and operations with the mindset that an attacker has already successfully penetrated their defenses. This proactive approach drives the implementation of robust detection, response, and recovery capabilities, alongside micro-segmentation and least-privilege access to minimize the blast radius of any potential compromise. It shifts focus from solely preventing breaches to building resilience and ensuring business continuity even when security controls are inevitably bypassed.

• ✗

  Grant access based on IP address

  Why it's wrong here

  Granting access solely based on an IP address is a legacy security model that is fundamentally incompatible with Zero Trust principles. IP addresses can be easily spoofed, reassigned, or associated with compromised devices, providing an insufficient and unreliable basis for establishing trust. Zero Trust mandates explicit verification of user identity, device health, location, and other contextual attributes for every access request, rather than relying on a static network-layer identifier.

• ✓

  Verify explicitly

  Why this is correct

  The "Verify explicitly" principle is a cornerstone of Zero Trust, requiring that all access requests, regardless of their origin, are thoroughly authenticated and authorized before access is granted. This involves evaluating all available data points in real-time, including user identity, device health, location, service, workload, and data classification. It ensures that trust is never assumed but is continuously and dynamically established based on a comprehensive assessment of the current context and risk.

• ✗

  Rely on network perimeter security

  Why it's wrong here

  Relying primarily on network perimeter security is antithetical to the Zero Trust model, which recognizes that traditional boundaries are no longer sufficient to protect modern, distributed environments. Perimeter-based security assumes that everything inside the network is inherently trustworthy, a dangerous assumption given the prevalence of insider threats and sophisticated external attacks. Zero Trust moves beyond this by applying security controls at the individual resource level, treating all network traffic and access requests as untrusted, regardless of their origin.

• ✗

  Use implicit trust for internal traffic

  Why it's wrong here

  Using implicit trust for internal network traffic directly contradicts the foundational tenets of Zero Trust, which operates on the principle of "never trust, always verify." The Zero Trust model explicitly rejects the notion that resources or users within an organization's internal network are inherently trustworthy simply because they are inside a traditional perimeter. Instead, every access request, whether originating internally or externally, must be explicitly verified and authorized based on identity and context before access is granted, enforcing consistent security policies everywhere.

Go deeper

Related to this question