Microsoft Security, Compliance, and Identity Fundamentals Zero Trust Security Model Flashcards

Which of the following is a core guiding principle of the Zero Trust security model?

Answer: Assume breach

The Zero Trust model operates on three core principles: Verify explicitly, Use least privileged access, and Assume breach. The 'Assume breach' principle means that you operate as if an attacker is already inside your network, minimizing the potential 'blast radius' through segmentation and continuous monitoring.

A company is implementing a Zero Trust strategy. They want to ensure that users are only granted the absolute minimum permissions required to perform their job functions. Which Zero Trust principle does this directly support?

Answer: Use least privileged access

The principle of 'Use least privileged access' is fundamental to Zero Trust. It involves limiting user access with Just-In-Time (JIT) and Just-Enough-Access (JEA), risk-based adaptive policies, and data protection to minimize the potential damage if an account is compromised.

In a Zero Trust model, what is the primary assumption made about network location?

Answer: No network location, internal or external, is implicitly trusted.

A core tenet of Zero Trust is to eliminate the concept of trust based on network location. It assumes that there is no traditional network edge and treats all requests as if they originate from an uncontrolled, external network, requiring verification for every access attempt regardless of its origin.

A security administrator is configuring access policies. According to the Zero Trust principle of 'Verify explicitly', which of the following signals should be used to inform an access decision?

Answer: The user's identity, device health, and location.

The 'Verify explicitly' principle requires authentication and authorization to be based on all available data points. This includes not just the user's identity, but also contextual signals like the location, the health and compliance of the device, the service or workload being accessed, and data classification.

A company has successfully implemented strong multi-factor authentication for all users. Which statement best describes their progress toward a complete Zero Trust model?

Answer: They have implemented a key component of the 'Identities' pillar, but more is needed.

Zero Trust is an end-to-end strategy covering multiple foundational pillars, including identities, devices, applications, data, infrastructure, and networks. Strong authentication is a critical part of the 'Identities' pillar and the 'Verify explicitly' principle, but it is only one piece of the overall Zero Trust architecture.

Which of the following actions is a direct application of the 'Assume breach' principle in a Zero Trust model?

Answer: Segmenting networks to limit lateral movement.

The 'Assume breach' principle involves minimizing the blast radius of an attack. Network segmentation is a key strategy for this, as it prevents an attacker who has compromised one part of the network from easily moving to other, more sensitive areas (lateral movement).