SC-900 Microsoft Security, Compliance, and Identity Fundamentals Zero Trust Security Model 4 — Questions and Answers
Question 1: Which Zero Trust pillar is addressed when implementing Azure Private Link to restrict access to Azure services?
- Identities
- Data
- Networks (Correct answer)
- Applications
Correct answer: Networks
Azure Private Link restricts Azure service access to private network connections, directly supporting the Zero Trust Networks pillar.
Question 2: Multi-factor authentication (MFA) is a core Zero Trust control that primarily strengthens which pillar?
- Networks
- Identities (Correct answer)
- Endpoints
- Infrastructure
Correct answer: Identities
MFA strengthens the Identities pillar by adding additional verification factors beyond passwords, reducing the risk of compromised credentials.
Question 3: What does Zero Trust mean by 'never trust, always verify'?
- Distrust all vendors by default
- No user or device is trusted automatically, even on the internal network (Correct answer)
- Require manual approval for every file download
- Block all guest users
Correct answer: No user or device is trusted automatically, even on the internal network
Zero Trust's 'never trust, always verify' means that trust is never implicit—every access request must be authenticated and authorized regardless of origin.
Question 4: Which feature in Microsoft Entra ID provides risk-based Zero Trust enforcement by detecting suspicious sign-in behaviors?
- Enterprise Application Registration
- Identity Protection (Correct answer)
- Administrative Units
- B2B Collaboration
Correct answer: Identity Protection
Microsoft Entra ID Protection uses machine learning to detect risky sign-ins and users, triggering step-up authentication or access blocks.
Question 5: How does Zero Trust handle east-west traffic (traffic between internal servers)?
- Allows it freely since it stays inside the network
- Inspects and controls it the same as north-south traffic (Correct answer)
- Encrypts it only when crossing VLANs
- Blocks it entirely unless VPN is used
Correct answer: Inspects and controls it the same as north-south traffic
Zero Trust treats east-west (lateral) traffic with the same scrutiny as north-south traffic because threats can originate from inside the network.
Question 6: Which Microsoft solution helps organizations visualize their Zero Trust posture and track improvement across all six pillars?
- Microsoft Secure Score (Correct answer)
- Azure Cost Management
- Microsoft Purview Audit
- Azure Advisor
Correct answer: Microsoft Secure Score
Microsoft Secure Score tracks an organization's security posture and provides recommended actions aligned to Zero Trust principles across all pillars.
Question 7: In Zero Trust architecture, what is the primary purpose of session controls?
- Speed up user authentication
- Monitor and limit what users can do during an active session (Correct answer)
- Replace passwords with biometrics
- Automatically renew expired certificates
Correct answer: Monitor and limit what users can do during an active session
Session controls in Zero Trust limit what authenticated users can do during a session, such as blocking downloads or requiring re-authentication for sensitive actions.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Zero Trust Security Model 4
Which Zero Trust pillar is addressed when implementing Azure Private Link to restrict access to Azure services?