A new CISO is reviewing an existing Microsoft 365 deployment where internal tra[ic is implicitly trusted once users connect through a VPN. They want…

Question breakdown

Tests

Describe Zero Trust principles

Difficulty

Easy

Key idea: Microsoft's Zero Trust model rests on three principles: verify explicitly, use least privilege access, and assume breach.

How to reach the answer

1. The scenario rejects implicit trust based on network location such as a VPN or corporate network.
2. It asks to treat every request as potentially hostile, which is the principle of assuming breach.
3. It asks to tightly limit what each identity can do, which is least privilege.
4. Only option D names all three Zero Trust principles; the others rely on location-based or session-wide trust.

Each option

• AIncorrect. Trusting devices because they are on the VPN is the location-based trust that Zero Trust removes.
• BIncorrect. Relying on the perimeter and trusting internal traffic describes the legacy model, not Zero Trust.
• CIncorrect. Strong sign-in followed by broad access for the whole session violates least privilege and continuous verification.
• DCorrect. It states the three Zero Trust principles, which match the CISO's goals.

Common trap: Option C is tempting because strong authentication sounds like Zero Trust, but one strong check followed by broad access is still implicit trust.

In practice: Zero Trust programs combine Conditional Access, device compliance, PIM, and segmentation so that every request is evaluated. Network location is never treated as sufficient on its own.

Remember: Zero Trust means verify explicitly, use least privilege, and assume breach, regardless of network location.

Official documentation: What is Zero Trust?

Drafted with AI assistance and checked against the answer key.