SC-100 Zero Trust Architecture 2 — Questions and Answers
Question 1: In a Zero Trust model, which principle ensures that users and devices are only granted access to the specific resources they need to perform their job functions?
- Defense in depth
- Least privilege access (Correct answer)
- Implicit trust
- Perimeter security
Correct answer: Least privilege access
Least privilege access restricts users and devices to only the minimum permissions required for their specific tasks, reducing the attack surface.
Question 2: Which Microsoft service provides the identity plane for Zero Trust by enabling conditional access policies based on user, device, location, and risk signals?
- Microsoft Defender for Endpoint
- Azure Entra ID (Azure AD) (Correct answer)
- Microsoft Sentinel
- Azure Firewall
Correct answer: Azure Entra ID (Azure AD)
Azure Entra ID serves as the identity control plane for Zero Trust, enabling conditional access policies that evaluate multiple risk signals before granting access.
Question 3: A company wants to apply Zero Trust principles to its network layer. Which Azure service allows micro-segmentation by filtering traffic between Azure resources at the subnet level?
- Azure DDoS Protection
- Network Security Groups (NSGs) (Correct answer)
- Azure Content Delivery Network
- Azure Traffic Manager
Correct answer: Network Security Groups (NSGs)
Network Security Groups enable micro-segmentation by applying inbound and outbound traffic rules at the subnet or NIC level within Azure virtual networks.
Question 4: When designing a Zero Trust strategy, 'assume breach' means an architect should:
- Require all traffic to pass through on-premises firewalls
- Design systems with the expectation that attackers may already be inside the network (Correct answer)
- Encrypt only data that leaves the corporate perimeter
- Block all external access to internal resources by default
Correct answer: Design systems with the expectation that attackers may already be inside the network
The 'assume breach' principle means designing architecture as if attackers may already be present, focusing on detection, containment, and minimizing blast radius.
Question 5: Which Zero Trust pillar focuses on classifying, labeling, and protecting sensitive information regardless of where it resides or travels?
- Identity
- Data (Correct answer)
- Applications
- Infrastructure
Correct answer: Data
The Data pillar of Zero Trust focuses on protecting sensitive data through classification, labeling, and encryption wherever it resides or moves.
Question 6: To validate device compliance in a Zero Trust architecture, which Microsoft service checks whether a device meets security requirements before granting access?
- Microsoft Intune (Correct answer)
- Azure DevOps
- Microsoft Purview
- Azure Key Vault
Correct answer: Microsoft Intune
Microsoft Intune enforces device compliance policies and integrates with Conditional Access to block or restrict access from non-compliant devices.
Question 7: In Zero Trust, 'verify explicitly' requires that access decisions are based on:
- Network location alone
- All available data points including identity, location, device health, and behavior (Correct answer)
- Whether the request originates from a trusted IP range
- The time of day the request is made
Correct answer: All available data points including identity, location, device health, and behavior
Verify explicitly means making access decisions using all available signals — identity, device compliance, location, service, workload, data classification, and anomalies.
SC-100 Zero Trust Architecture 2
In a Zero Trust model, which principle ensures that users and devices are only granted access to the specific resources they need to perform their job functions?