SC-900 Microsoft Security, Compliance, and Identity Fundamentals Zero Trust Security Model 2 — Questions and Answers
Question 1: Which Zero Trust guiding principle states that access should be limited to only what is needed to perform a task?
- Verify explicitly
- Use least privilege access (Correct answer)
- Assume breach
- Segment networks
Correct answer: Use least privilege access
The 'Use least privilege access' principle limits user access with just-in-time and just-enough-access policies to minimize exposure.
Question 2: In Zero Trust, what does 'assume breach' mean for network design?
- Disable all firewalls
- Segment networks to contain blast radius (Correct answer)
- Trust all internal traffic
- Block all external connections
Correct answer: Segment networks to contain blast radius
Assuming breach means designing networks with segmentation so that if one area is compromised, attackers cannot move freely to other areas.
Question 3: Which Microsoft service helps implement Zero Trust by providing conditional access policies?
- Microsoft Defender for Endpoint
- Microsoft Entra ID (Azure AD) (Correct answer)
- Microsoft Purview
- Azure Firewall
Correct answer: Microsoft Entra ID (Azure AD)
Microsoft Entra ID provides Conditional Access policies that enforce Zero Trust by evaluating signals before granting access.
Question 4: Zero Trust replaces which traditional security model?
- Defense-in-depth model
- Castle-and-moat (perimeter-based) model (Correct answer)
- Shared responsibility model
- Zero-knowledge model
Correct answer: Castle-and-moat (perimeter-based) model
Zero Trust replaces the castle-and-moat model where everything inside the network perimeter was trusted by default.
Question 5: Which pillar of Zero Trust focuses on protecting data through classification and encryption?
- Identities
- Endpoints
- Data (Correct answer)
- Networks
Correct answer: Data
The Data pillar in Zero Trust focuses on classifying, labeling, and encrypting data and controlling access based on data sensitivity.
Question 6: What technology enables Zero Trust by continuously verifying device health before granting access?
- VPN tunneling
- Device compliance policies (Correct answer)
- Static IP allowlisting
- MAC address filtering
Correct answer: Device compliance policies
Device compliance policies assess device health, OS version, and configuration to ensure only healthy devices can access resources.
Question 7: In the Zero Trust model, how should applications be treated regardless of where they are hosted?
- Trust apps on corporate servers completely
- Verify every app request as if it comes from an untrusted network (Correct answer)
- Only monitor third-party apps
- Grant admin access to all internal apps
Correct answer: Verify every app request as if it comes from an untrusted network
Zero Trust treats all applications as untrusted and requires verification of every request regardless of the hosting location.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Zero Trust Security Model 2
Which Zero Trust guiding principle states that access should be limited to only what is needed to perform a task?