The answer is the Zero Trust security model. This is correct because Zero Trust is built on the core principles of explicit verification, least privilege access, and the assumption of breach, meaning no user, device, or network is trusted by default—every access request must be continuously validated regardless of its origin. On the Microsoft SC-900 exam, this concept tests your understanding of how Zero Trust shifts security from a traditional perimeter-based approach to a "never trust, always verify" mindset, often appearing in scenario-based questions that contrast it with legacy models. A common trap is confusing Zero Trust with a simple VPN or firewall, but remember that Zero Trust requires micro-segmentation and continuous authentication, not just a single checkpoint. Memory tip: think of the three pillars—Verify explicitly, use least privilege, and assume breach—to quickly identify Zero Trust in any exam scenario.
SC-900 Practice Question: Describe the concepts of security, compliance, and identity
This SC-900 practice question tests your understanding of describe the concepts of security, compliance, and identity. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization adopts a security model that requires explicit verification of every access request, uses least privilege principles, and assumes that a breach has already occurred. Which security model does this describe?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "least"
Why it matters: You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.
Why wrong: Perimeter-based security focuses on defending the network boundary and trusts users inside the network, contrary to assuming breach.
B
Defense in depth
Why wrong: Defense in depth uses multiple layers of security controls but does not inherently require explicit verification or assume breach.
C
Zero Trust
Zero Trust explicitly verifies every access, enforces least privilege, and assumes breach, matching the description.
D
Shared responsibility
Why wrong: Shared responsibility is a cloud security model that delineates security obligations between the provider and customer, not a general security model.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Zero Trust
Zero Trust is the correct answer because the model explicitly requires verification of every access request, enforces least privilege, and assumes breach. This aligns with the core Zero Trust principles of 'never trust, always verify,' continuous validation, and micro-segmentation, as opposed to traditional perimeter-based models that implicitly trust internal traffic.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Perimeter-based security
Why it's wrong here
Perimeter-based security focuses on defending the network boundary and trusts users inside the network, contrary to assuming breach.
✗
Defense in depth
Why it's wrong here
Defense in depth uses multiple layers of security controls but does not inherently require explicit verification or assume breach.
✓
Zero Trust
Why this is correct
Zero Trust explicitly verifies every access, enforces least privilege, and assumes breach, matching the description.
Clue confirmation
The clue word "least" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Shared responsibility
Why it's wrong here
Shared responsibility is a cloud security model that delineates security obligations between the provider and customer, not a general security model.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse 'defense in depth' with Zero Trust because both involve multiple security layers, but defense in depth does not require explicit verification of every request or the assumption of breach, which are unique to Zero Trust.
Detailed technical explanation
How to think about this question
Zero Trust architectures often use technologies like Azure AD Conditional Access to enforce real-time policy evaluation based on user, device, location, and risk signals. Under the hood, this involves token claims validation, device compliance checks via Intune, and session risk scoring from Azure AD Identity Protection, ensuring that even authenticated users are re-verified for each resource access. A real-world scenario is a user accessing a sensitive SharePoint site from an unmanaged device—Zero Trust would block or limit access despite valid credentials, because the device trust score is low.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-900 question in full detail.
Describe the concepts of security, compliance, and identity — This question tests Describe the concepts of security, compliance, and identity — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Zero Trust — Zero Trust is the correct answer because the model explicitly requires verification of every access request, enforces least privilege, and assumes breach. This aligns with the core Zero Trust principles of 'never trust, always verify,' continuous validation, and micro-segmentation, as opposed to traditional perimeter-based models that implicitly trust internal traffic.
What should I do if I get this SC-900 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "least". You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization adopts a security model where they never trust a request by default, even if it comes from inside the corporate network. Every access request must be authenticated, authorized, and encrypted. They also assume that a breach will happen and design their systems to minimize the blast radius. Which security model does this describe?
easy
A.A
B.B
✓ C.C
D.D
Why C: This scenario describes the Zero Trust security model, which operates on the principle of 'never trust, always verify.' It requires authentication, authorization, and encryption for every access request, regardless of origin (inside or outside the network), and assumes breach to minimize blast radius through microsegmentation and least-privilege access. Option C is correct because it aligns with the core tenets of Zero Trust as defined by NIST SP 800-207.
Variation 2. An organization adopts a Zero Trust security model. Which principle requires that every access request must be explicitly verified and granted least privilege regardless of the user's location or device?
easy
✓ A.Verify explicitly
B.Use least privilege access
C.Assume breach
D.Never trust, always verify
Why A: The Zero Trust principle 'Verify explicitly' mandates that every access request—regardless of the user's location, device, or network—must be authenticated and authorized based on all available data points (e.g., user identity, device health, location, and real-time risk signals). This ensures that no implicit trust is granted, and least privilege is applied as a separate but complementary principle. In Microsoft's Zero Trust model, this is enforced through conditional access policies and continuous evaluation of session risk.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.