Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Zero Trust Least Privilege Access in Azure
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is modernizing its security architecture in Azure. The security team wants to adopt a Zero Trust strategy to safeguard corporate data and cloud resources.
The team establishes the following access requirements:
- Users must only be granted the minimum permissions necessary to perform their work tasks.
- Elevated permissions must be granted just-in-time and revoked when no longer required.
- Access policies must limit data exposure based on specific job roles and context.
Which guiding principle of the Zero Trust security model does this strategy represent?
Explanations
Verify explicitly
Verify explicitly
What Verify Explicitly Is
Verify explicitly is the Zero Trust principle centered on the tenet of "never trust, always verify." It requires that every access request be fully authenticated, authorized, and validated against all available data points before access is granted.
Why It Doesn't Meet the Requirement
Although verify explicitly checks credentials and context during an authentication attempt (such as user identity, device health, location, and service anomalies), it does not define the policy of limiting permissions to the bare minimum or making access time-limited.
Key Characteristics and Limitations
- Multi-Factor Authentication (MFA): Enforces robust verification methods for all incoming authentication attempts.
- Contextual signals: Evaluates device compliance, geographic location, IP reputation, and real-time risk scores.
- Continuous validation: Re-evaluates trust continuously rather than granting blanket trust after an initial sign-in.
This Answer Would Be Correct If
The organization needed a mechanism to evaluate user location, device compliance, and Multi-Factor Authentication prompts on every single sign-in request before allowing entry.
Additional Context
Explicit verification determines whether an identity is legitimate and trusted, while least privilege defines what that verified identity is allowed to do.
Use least privilege access
Use least privilege access
What Least Privilege Access Is
Least privilege access is one of the three foundational guiding principles of the Zero Trust security model. This principle dictates that identities—whether human users, automated workloads, or service principals—should only be granted the exact level of access required to perform their specific duties, and nothing more.
How It Meets the Requirements
- Restricting excessive permissions: Limiting user rights prevents accounts from holding broad, administrative privileges by default, significantly reducing potential blast radiuses.
- Just-In-Time (JIT) and Just-Enough-Access (JEA): Zero Trust enforces adaptive, time-bound access where permissions are granted dynamically for a specific duration and revoked immediately after completion.
- Data exposure control: Enforcing role-based permissions ensures that sensitive information is only accessible to users with a validated business need.
Key Advantages and Capabilities
- Minimizes attack surface: Limits what an attacker or compromised account can access or modify across the environment.
- Reduces lateral movement: Restricts compromised credentials from pivoting across different corporate resources or subscriptions.
- Enforces granular governance: Employs tools such as access reviews, attribute-based access controls, and privileged identity management.
- Protects sensitive data: Enforces explicit data access policies so data sharing is scoped, time-limited, and audited.
Why This Is Optimal
Rather than granting standing broad access across workloads, enforcing least privilege access ensures every transaction is constrained by context, identity, and time limits, directly fulfilling all stated security requirements.
Perimeter-based network defense
Perimeter-based network defense
What Perimeter-Based Network Defense Is
Perimeter-based network defense is a traditional security model (often referred to as "castle-and-moat") that assumes everything inside the corporate network boundary is trustworthy, while everything outside is untrusted.
Why It Doesn't Meet the Requirement
Perimeter-based security is the opposite of the Zero Trust philosophy. In a perimeter-centric model, once a user or device breaches the firewall or connects via VPN, they often receive broad internal access without granular, time-bound permission checks.
Key Characteristics and Limitations
- Static network boundaries: Relies heavily on edge firewalls and VPNs to secure the corporate perimeter.
- Implicit internal trust: Fails to protect against insider threats or attackers who have compromised internal credentials.
- Inflexible for cloud environments: Ineffective for modern cloud, remote work, and Software-as-a-Service (SaaS) architectures.
This Answer Would Be Correct If
The scenario described legacy security approaches that relied strictly on edge firewalls and private corporate intranets where internal users are implicitly trusted.
Additional Context
Zero Trust replaces implicit trust models by removing the assumption that internal network location equates to security or authorization.
Assume breach
Assume breach
What Assume Breach Is
Assume breach is a core Zero Trust principle that treats the environment as if an adversary or security breach has already occurred or is currently in progress within the network perimeter.
Why It Doesn't Meet the Requirement
While assume breach is essential to a comprehensive security strategy, it focuses on minimizing the damage of an active compromise rather than the policy mechanism of scoping user permissions. Its primary implementation involves segmenting networks, encrypting data end-to-end, and leveraging analytics to detect threats in real time.
Key Characteristics and Limitations
- Micro-segmentation: Divides internal networks and resources into isolated segments to prevent uninhibited lateral movement.
- End-to-end encryption: Protects communication channels and data at rest regardless of network location.
- Threat detection: Focuses on telemetry, continuous monitoring, and security information event management (SIEM).
This Answer Would Be Correct If
The scenario focused on encrypting all internal communications, dividing virtual networks into isolated micro-segments, and utilizing automated threat detection to respond to security incidents.
Additional Context
Assuming breach works together with least privilege, but least privilege is specifically concerned with restricting rights and time-limiting user access.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Zero Trust Least Privilege Just-In-Time Access
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Conditional Access
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra ID Protection
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Managed Identities
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Defense-in-Depth Perimeter Layer
Describe the purpose of the defense-in-depth model
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
Managed Identity for Azure DevOps Service Connections
Implement and manage Azure DevOps service connections and personalaccess tokens
Last updated Validated