SC-900 - Microsoft Security, Compliance, and Identity Fundamentals Zero Trust Security Model Questions and Answers — Questions and Answers
Question 1: Which of the following is a core guiding principle of the Zero Trust security model?
- Trust but verify
- Assume breach (Correct answer)
- Perimeter-based security
- Implicit trust for internal networks
Correct answer: Assume breach
The Zero Trust model operates on three core principles: Verify explicitly, Use least privileged access, and Assume breach. The 'Assume breach' principle means that you operate as if an attacker is already inside your network, minimizing the potential 'blast radius' through segmentation and continuous monitoring.
Question 2: A company is implementing a Zero Trust strategy. They want to ensure that users are only granted the absolute minimum permissions required to perform their job functions. Which Zero Trust principle does this directly support?
- Verify explicitly
- Assume breach
- Use least privileged access (Correct answer)
- Defense-in-depth
Correct answer: Use least privileged access
The principle of 'Use least privileged access' is fundamental to Zero Trust. It involves limiting user access with Just-In-Time (JIT) and Just-Enough-Access (JEA), risk-based adaptive policies, and data protection to minimize the potential damage if an account is compromised.
Question 3: In a Zero Trust model, what is the primary assumption made about network location?
- Requests from the corporate office are inherently trusted.
- Devices on the internal network are secure by default.
- External networks are untrusted, while internal networks are trusted.
- No network location, internal or external, is implicitly trusted. (Correct answer)
Correct answer: No network location, internal or external, is implicitly trusted.
A core tenet of Zero Trust is to eliminate the concept of trust based on network location. It assumes that there is no traditional network edge and treats all requests as if they originate from an uncontrolled, external network, requiring verification for every access attempt regardless of its origin.
Question 4: A security administrator is configuring access policies. According to the Zero Trust principle of 'Verify explicitly', which of the following signals should be used to inform an access decision?
- Only the user's password.
- The user's identity, device health, and location. (Correct answer)
- Only the user's group membership.
- Whether the user is inside the corporate firewall.
Correct answer: The user's identity, device health, and location.
The 'Verify explicitly' principle requires authentication and authorization to be based on all available data points. This includes not just the user's identity, but also contextual signals like the location, the health and compliance of the device, the service or workload being accessed, and data classification.
Question 5: A company has successfully implemented strong multi-factor authentication for all users. Which statement best describes their progress toward a complete Zero Trust model?
- They have fully implemented Zero Trust.
- They have implemented a key component of the 'Identities' pillar, but more is needed. (Correct answer)
- They have completed the 'Assume breach' principle.
- They have addressed network security, but not identity.
Correct answer: They have implemented a key component of the 'Identities' pillar, but more is needed.
Zero Trust is an end-to-end strategy covering multiple foundational pillars, including identities, devices, applications, data, infrastructure, and networks. Strong authentication is a critical part of the 'Identities' pillar and the 'Verify explicitly' principle, but it is only one piece of the overall Zero Trust architecture.
Question 6: Which of the following actions is a direct application of the 'Assume breach' principle in a Zero Trust model?
- Implementing multi-factor authentication for all users.
- Segmenting networks to limit lateral movement. (Correct answer)
- Assigning global administrator roles to all IT staff.
- Trusting all devices that are owned by the corporation.
Correct answer: Segmenting networks to limit lateral movement.
The 'Assume breach' principle involves minimizing the blast radius of an attack. Network segmentation is a key strategy for this, as it prevents an attacker who has compromised one part of the network from easily moving to other, more sensitive areas (lateral movement).
SC-900 - Microsoft Security, Compliance, and Identity Fundamentals Zero Trust Security Model Questions and Answers
Which of the following is a core guiding principle of the Zero Trust security model?