Zero Trust Security Model: Never Trust, Always Verify
An organization adopts a security model that requires explicit verification of every access request, uses least privilege principles, and assumes that a breach has already occurred. Which security model does this describe?
Quick Answer
The answer is the Zero Trust security model. This is correct because Zero Trust is built on the core principles of explicit verification, least privilege access, and the assumption of breach, meaning no user, device, or network is trusted by default—every access request must be continuously validated regardless of its origin. On the Microsoft SC-900 exam, this concept tests your understanding of how Zero Trust shifts security from a traditional perimeter-based approach to a "never trust, always verify" mindset, often appearing in scenario-based questions that contrast it with legacy models. A common trap is confusing Zero Trust with a simple VPN or firewall, but remember that Zero Trust requires micro-segmentation and continuous authentication, not just a single checkpoint. Memory tip: think of the three pillars—Verify explicitly, use least privilege, and assume breach—to quickly identify Zero Trust in any exam scenario.
⚠ Common exam trap
It's easy for candidates to confuse 'defense in depth' with Zero Trust because both involve multiple security layers, but defense in depth does not require explicit verification of every request or the assumption of breach, which are unique to Zero Trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Zero Trust
Zero Trust is the correct answer because the model explicitly requires verification of every access request, enforces least privilege, and assumes breach. This aligns with the core Zero Trust principles of 'never trust, always verify,' continuous validation, and micro-segmentation, as opposed to traditional perimeter-based models that implicitly trust internal traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perimeter-based security
Why it's wrong here
Perimeter-based security trusts everything inside a defended boundary after initial authentication, directly contradicting explicit verification of every request and breach assumption. It is tempting as a familiar network defence model, but it would be correct when describing firewall-centric architectures rather than Zero Trust.
- ✗
Defense in depth
Why it's wrong here
Defence in depth layers multiple controls to slow attackers, but it does not mandate per-request verification or least privilege as its defining principle. It is tempting because layered controls appear in Zero Trust designs, yet it would be correct when describing overlapping safeguards rather than the verify-explicitly, assume-breach model.
- ✓
Zero Trust
Why this is correct
Zero Trust mandates explicit verification of every access request, enforces least-privilege access, and assumes breach, matching all three conditions in the stem. It replaces implicit network-trust models, where internal traffic is assumed safe, with continuous authentication and authorisation per request.
- ✗
Shared responsibility
Why it's wrong here
Shared responsibility defines how security duties divide between provider and customer across cloud layers; it says nothing about verifying every request or assuming breach. It is tempting because it underpins cloud governance, but it would be correct when clarifying who secures what, not when describing Zero Trust principles.
Go deeper
Related to this question
Learn chapter
Microsoft Security Baselines
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization adopts a security model where they never trust a request by default, even if it comes from inside the corporate network. Every access request must be authenticated, authorized, and encrypted. They also assume that a breach will happen and design their systems to minimize the blast radius. Which security model does this describe?
easy- A.Defense in depth
- B.Shared responsibility model
- ✓ C.Zero Trust
- D.Perimeter-based security
Why C: This describes Zero Trust: never trust any request by default, even from inside the network; always authenticate, authorize, and encrypt; assume breach and limit blast radius. Defense in depth adds layers but does not require distrusting internal traffic by default. Shared responsibility assigns security duties between cloud provider and customer. Perimeter-based security typically trusts internal traffic.
Variation 2. An organization adopts a Zero Trust security model. Which principle requires that every access request must be explicitly verified and granted least privilege regardless of the user's location or device?
easy- ✓ A.Verify explicitly
- B.Use least privilege access
- C.Assume breach
- D.Never trust, always verify
Why A: The Zero Trust principle 'Verify explicitly' mandates that every access request—regardless of the user's location, device, or network—must be authenticated and authorized based on all available data points (e.g., user identity, device health, location, and real-time risk signals). This ensures that no implicit trust is granted, and least privilege is applied as a separate but complementary principle. In Microsoft's Zero Trust model, this is enforced through conditional access policies and continuous evaluation of session risk.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.