Zero Trust explained for security exams

Zero Trust is a security model that drops the idea of a trusted internal network: every request is verified on its own evidence, whatever network it comes from. Microsoft states it as three principles, verify explicitly, use least privilege access and assume breach. The decision rule for the exam: if a scenario trusts a user or device because it is on the corporate network or behind the VPN, that is the old model; if the answer checks identity, device health and context on every request, grants only what is needed and limits damage if something is compromised, that is Zero Trust.

From the castle wall to checking every door

The older perimeter model worked like a castle. A firewall guarded the edge, and anything inside was trusted. It fails when staff work from home, applications run in several clouds, and an attacker who steals one password arrives already “inside”. Microsoft’s own overview makes the same point: modern attacks rely on identity compromise, phishing and session hijacking, not on network location.

The US standard NIST SP 800-207 defines Zero Trust as a set of paradigms that move defences from static, network-based perimeters to users, assets and resources. Its core statement is that no implicit trust is granted to an account or device only because of its physical or network location or because of who owns the device. Authentication and authorization of both the subject and the device happen before a session to a resource is established.

The three principles, with what each demands

Principle	In practice	A control that implements it
Verify explicitly	Use every signal available: identity, device state, location, risk, the application being requested	MFA, Conditional Access, device compliance checks
Use least privilege access	Give the minimum access, for the minimum time, scoped to the task	Role-based access, just-in-time activation, limited scopes
Assume breach	Design as if an attacker is already present: limit blast radius, encrypt, watch for abuse	Network segmentation, encryption in transit and at rest, logging and threat detection

Microsoft groups its guidance by technology pillars, such as identity, data and devices, so a Zero Trust scenario often turns out to be a question about one specific pillar.

The decision machinery behind it

NIST describes a logical split that the exam occasionally borrows. A policy engine decides whether to grant access, using policy and signals. A policy administrator carries out that decision by establishing or tearing down the session. Together they form the policy decision point. A policy enforcement point sits in front of the resource and permits or blocks the connection accordingly. In vendor terms, Conditional Access in Microsoft Entra ID is the policy decision, and the application or gateway that honours the resulting token is the enforcement.

Remember the direction of flow: the user never talks to the resource directly first. The request passes the enforcement point, which asks the decision component, and only then is access granted.

A worked example: the contractor and the HR system

A contractor needs to read project records in an internal application. Under the old model the company gives her a VPN account. Once connected she can reach the whole internal subnet, including systems she has no business with.

The Zero Trust redesign changes four things:

Verify explicitly. She signs in with MFA, from a device that must report as healthy. If the device is unmanaged or the sign-in looks risky, access is blocked or limited to a browser session with downloads disabled.
Least privilege. She is assigned only the role for that one application, and the assignment expires when the contract ends.
Assume breach. The application sits in its own network segment, so a compromise of her laptop cannot be used to scan the rest of the network. Traffic is encrypted and her sign-ins are logged and monitored for anomalies.
No location trust. Being on the office network gives no extra rights. The same checks apply in the office and at home.

Notice that Zero Trust is not a product. It is a design approach that uses identity, device management, segmentation, encryption and monitoring together. No single purchase makes an organisation “Zero Trust”.

Which exams test this

Exam	How it appears	Where it is covered here
SY0-801	General security concepts (16%): Zero Trust principles among the security concepts (1.1); Security architecture (19%): a Zero Trust architecture with user authentication, device health and inventory, and application access control (3.2)	General security concepts, Security architecture
SC-900	Concepts of security, compliance, and identity (10–15%): describe the Zero Trust model, next to shared responsibility and defense in depth	Security, compliance and identity concepts
AZ-900	Azure architecture and services (35–40%): describe the concept of Zero Trust, under identity, access and security	Architecture and services
AB-900	Core features and objects of Microsoft 365 services (30–35%): explain the core Zero Trust principles	Microsoft 365 core features
N10-009	Networking concepts (23%): Zero Trust architecture with policy-based authentication, authorization and least privilege access, among modern network use cases (1.8)	N10-009 networking concepts explained

SY0-801 launches on November 17, 2026; until then SY0-701 is the live Security+ exam. SC-900 and AB-900 rows follow the English outlines that take effect in October 2026 (minor changes).

How exam questions are built around it

Three patterns account for most questions.

Name the principle. The scenario describes a control and asks which principle it supports. Map the control to the verb: checking MFA, device compliance and risk on each sign-in is “verify explicitly”; time-limited, narrow role assignments are “least privilege”; segmentation, encryption and monitoring are “assume breach”. The wrong options are usually the other two principles, so look for the one that fits the control best.

Spot the perimeter assumption. Options such as “allow all traffic from the internal network” or “trust devices connected to the corporate VPN” are traps. Phrases like “regardless of location”, “every request” and “continuously” signal Zero Trust. Words such as “trusted network”, “inside the firewall” and “once authenticated, full access” signal the opposite.

Difference from defense in depth. Defense in depth stacks layers so that one failure does not expose everything. Zero Trust questions the trust given at each layer. They are complementary, and a question asking for the model that removes implicit trust based on network location wants Zero Trust, not defense in depth.

A further trap: “assume breach” is about limiting damage, not about giving up on prevention. If the option reduces the blast radius, such as segmentation, it matches; an option that just adds another perimeter firewall does not.

Practice questions

Question 1. A company replaces its VPN-only access model. Under the new design, every access request to the finance application is evaluated using the user's identity, the health of the device and the sign-in risk, no matter whether the user is in the office or at home. Which Zero Trust principle is MOST directly applied?

A. Verify explicitly
B. Use least privilege access
C. Assume breach
D. Defense in depth

Show answer

Answer: A

Verify explicitly means authenticating and authorizing every request using all available signals such as identity, device health, location and risk. Least privilege is about limiting the scope and duration of access. Assume breach is about limiting damage through segmentation, encryption and monitoring. Defense in depth is a layering strategy, not one of the three Zero Trust principles.

Question 2. A security architect proposes placing the file servers on a separate network segment with per-application access rules, so a compromised workstation cannot be used to scan the entire network. Which Zero Trust principle does this design primarily support?

A. Verify explicitly
B. Trust the internal network
C. Assume breach
D. Use least privilege access