Agentic AI is quietly rewriting the enterprise threat model, and Zero Trust identity is the frontline. Recent industry reports show that non-human identities — service accounts, API keys, and now AI agents — outnumber human users in many organizations by more than 40 to 1. Gartner projects that a third of enterprise applications will embed agentic AI by 2028, so every one of those agents needs an identity, a permission scope, and continuous verification.
That shift is exactly why the SC-900 blueprint keeps Zero Trust identity at the center of Domain 1. Microsoft’s exam expects you to explain the three Zero Trust principles, contrast authentication with authorization, and pick the right control for a given scenario. However, memorizing definitions is not enough. As a result, the real exam presents small scenarios and asks you to choose the best fit.
This is the first post in our SC-900 series (Questions 1-10). Therefore, we will focus on foundational Zero Trust identity concepts, defense in depth, encryption basics, and the Microsoft Entra features that enforce them. Reveal each answer only after you commit to a choice. Read the scenario, eliminate two options, and only then pick between the last two. In addition, jot down the “why” for each wrong answer — that habit alone will lift your score five to ten points on exam day.
Difficulty in this set is deliberately mixed. Specifically, Questions 1, 3, and 4 are quick warm-ups on core vocabulary. Questions 2, 5, 6, 7, and 8 test the everyday distinctions Microsoft loves to trap you on. Questions 9 and 10 climb into scenario territory that mirrors the toughest items on the real exam. Let’s begin.
Question 1: Zero Trust Identity Principles in Practice
Contoso is updating its access strategy to align with Zero Trust. Leadership wants a short statement that captures the guiding principle behind requiring both a compliant device and multi-factor authentication (MFA) on every sign-in, regardless of network location. Which Zero Trust principle best matches this behavior?
A) Assume breach
B) Verify explicitly
C) Use least privilege access
D) Trust but verify
👁 Reveal Answer
Correct Answer: B
Explanation: “Verify explicitly” means every access request is authenticated and authorized using all available signals — user identity, device compliance, location, and risk — instead of trusting the network perimeter. In practice, that is exactly what a policy demanding MFA plus device compliance does on every sign-in. A is a real Zero Trust principle, but it focuses on containment (segmentation, encryption, telemetry) rather than the sign-in decision itself. C is also a valid principle, but it governs the scope of permissions granted, not the check performed at sign-in. D is the older “trust but verify” model that Zero Trust explicitly replaces. Watch for D on the exam — it is a common distractor that sounds Zero-Trust-adjacent but predates the framework.
Question 2: Least Privilege with Just-in-Time Access
Fabrikam runs a fintech workload on Azure. Compliance requires that administrators hold elevated roles only while performing a task, and that every activation is reviewed. Which Microsoft Entra capability best delivers this least-privilege pattern?
A) Microsoft Entra Connect Sync
B) Conditional Access policies
C) Privileged Identity Management (PIM)
D) Access reviews for guest users
👁 Reveal Answer
Correct Answer: C
Explanation: Privileged Identity Management provides just-in-time role activation with approval, MFA on elevation, and an auditable history — the textbook control for least privilege on admin roles. Specifically, an administrator becomes an “eligible” role holder rather than a permanent one, and elevates only for a bounded window. A synchronizes identities from on-premises Active Directory and does not control activation. B enforces sign-in conditions such as MFA or blocking risky locations, but it does not by itself time-box a role assignment. D reviews standing access to groups or apps periodically; it is a good complementary control, however, PIM is the direct answer for time-bound elevation with an approval workflow. On the exam, look for the words “just in time,” “eligible,” or “activation” — they are strong PIM signals.
Question 3: Defense in Depth Layers
Your platform team is drawing a defense-in-depth diagram for the leadership review. They need to show the layer that focuses on protecting the credentials, tokens, and role assignments that let users and workloads reach a resource. Which layer of the defense-in-depth model does this describe?
A) Physical security
B) Perimeter
C) Identity and access
D) Application
👁 Reveal Answer
Correct Answer: C
Explanation: The identity and access layer is specifically about who can prove they are who they say they are and what they can then do — credentials, MFA, tokens, and role assignments live here. A protects the buildings and hardware. B focuses on DDoS protection and edge filtering. D deals with secure coding, secret management inside the app, and input validation. Because the question asks about credentials and role assignments, only C fits precisely.
Question 4: The CIA Triad
Woodgrove Bank stores loan documents in cloud storage. Auditors ask the security lead to describe the control that prevents an insider from altering a signed contract after upload. Which element of the CIA triad is being protected?
A) Confidentiality
B) Integrity
C) Availability
D) Accountability
👁 Reveal Answer
Correct Answer: B
Explanation: Integrity ensures data has not been changed in an unauthorized or undetected way. Immutable blob storage, digital signatures, and hash validation all support integrity. A would apply to keeping the contract secret from outsiders. C would cover uptime and recoverability. D is a related security concept (traceability of actions), but it is not one of the three CIA pillars.
Question 5: Encryption at Rest vs. In Transit
Northwind Traders operates a public web API. The team encrypts backups saved to blob storage and forces HTTPS for all client calls. Which pairing correctly labels these two protections?
A) Both are encryption in transit
B) Backups: at rest; HTTPS: in transit
C) Backups: in transit; HTTPS: at rest
D) Both are encryption at rest
👁 Reveal Answer
Correct Answer: B
Explanation: Encryption at rest protects stored data on disk, so encrypted backups clearly belong there. Encryption in transit protects data moving between endpoints, which is exactly what TLS via HTTPS provides. As a result, the correct mapping is backups at rest and HTTPS in transit. A, C, and D each mislabel one or both, which is a common trap on SC-900. In addition, remember that Azure Storage and Azure SQL apply service-managed encryption at rest by default, while HTTPS enforcement is a separate toggle you turn on per storage account or app.
Question 6: Authentication vs. Authorization
The security lead at Litware is coaching a new hire. They want a one-sentence rule for telling authentication apart from authorization. Which statement is correct?
A) Authentication decides what a user can do; authorization proves who they are
B) Authentication proves who a user is; authorization decides what they can do
C) Both terms describe the sign-in event and are interchangeable
D) Authentication is only for humans; authorization is only for services
👁 Reveal Answer
Correct Answer: B
Explanation: Authentication (AuthN) verifies identity — typically with a password plus MFA. Authorization (AuthZ) then decides which resources or actions that verified identity may access, usually through role assignments or policies. A flips the two definitions. C treats them as one step, which is incorrect. D is wrong because both concepts apply equally to humans, services, and non-human identities such as agents.
Question 7: Federation and Single Sign-On
Adventure Works handles a merger with a partner company. Employees at the partner need to reach two SaaS apps with their existing corporate credentials, without a new username or password. Which concept best describes this arrangement?
A) Password hash synchronization
B) Federation
C) Multi-factor authentication
D) Role-based access control
👁 Reveal Answer
Correct Answer: B
Explanation: Federation establishes a trust between two identity providers so users authenticated by one can reach resources in the other — the foundation of cross-tenant single sign-on. For example, a partner’s Microsoft Entra tenant can issue tokens that Adventure Works trusts, so the partner user never needs a new credential. A is a hybrid sync mechanism, not a trust relationship between organizations. C strengthens a sign-in but does not enable cross-organization access. D governs what a user can do after signing in, not how they sign in from another tenant. Watch for exam wording such as “trust between organizations” or “existing corporate credentials” — those cue federation every time.
Question 8: MFA Authentication Factors
During a design review, an architect lists these three MFA factors: something you know, something you have, and something you are. The team then asks which factor a Windows Hello face scan represents. Which category best fits?
A) Something you know
B) Something you have
C) Something you are
D) Somewhere you are
👁 Reveal Answer
Correct Answer: C
Explanation: Biometric factors — face, fingerprint, voice — map to “something you are.” A covers passwords or PINs. B covers phones, tokens, or FIDO2 keys. D (location) is sometimes used as a signal in Conditional Access, but it is not one of the three classic MFA factor categories. Windows Hello for Business specifically uses biometrics bound to the device, which is why C is correct.
Question 9: Conditional Access for Risky Sign-Ins (Zero Trust Identity in Action)
Tailwind Traders is piloting Microsoft Entra ID Protection. The security team wants sign-ins that Entra classifies as “high risk” to be blocked, while medium-risk sign-ins should be forced to complete MFA. Which Microsoft Entra feature enforces both rules together?
A) Microsoft Defender for Cloud Apps policies
B) Conditional Access policies with sign-in risk conditions
C) Access reviews on the Global Administrator role
D) Continuous access evaluation with no additional policy
👁 Reveal Answer
Correct Answer: B
Explanation: Conditional Access is Microsoft Entra’s Zero Trust policy engine. Specifically, sign-in risk conditions from Identity Protection can trigger a block for high-risk events and require MFA for medium-risk events in a single policy. A protects SaaS session activity, not the sign-in decision. C reviews standing role assignments and does not react to risk signals. D is a real feature that revokes tokens when risk changes mid-session, but on its own it does not enforce the risk-based grant rules the scenario asks for.
Question 10: Non-Human Identities for AI Agents
A retail chain, Coho Vineyard, deploys an AI agent that calls Azure resources on behalf of the business. The CIO wants the agent to hold its own auditable identity in Microsoft Entra, with permissions scoped to just the resources it needs. Which identity type best fits?
A) A shared user account for the agent team
B) A guest (B2B) account
C) A workload identity (service principal or managed identity)
D) A break-glass administrator account
👁 Reveal Answer
Correct Answer: C
Explanation: Workload identities — service principals and managed identities — are Microsoft Entra’s answer for non-human callers such as apps, workloads, and AI agents. They can be governed with Conditional Access for workload identities, scoped with least-privilege role assignments, and audited independently of any employee. Managed identities are the preferred flavor because Azure rotates their credentials automatically, which eliminates the “leaked secret” risk that plagued long-lived service principal secrets. A creates accountability gaps and violates least privilege — if the agent misbehaves, no single owner is on the hook. B is meant for external human users, not workloads. D is reserved for emergency human access and must never be tied to routine automation. Therefore, C is the only option that keeps Zero Trust identity intact for autonomous agents. Expect this pattern to appear repeatedly on future SC-900 exams as agentic AI adoption climbs.
Study Tips for Zero Trust Identity on SC-900
These five habits will pay off across the exam and, honestly, on your day job too.
- Learn the three principles cold. “Verify explicitly, use least privilege, assume breach” is the framework the exam grades every scenario against. If you can map a control to a principle, you can usually pick the right answer.
- Separate AuthN from AuthZ. Many wrong answers deliberately swap these two words. Read carefully.
- Know Microsoft Entra by feature, not just by name. Conditional Access enforces the sign-in decision. PIM time-boxes admin roles. Identity Protection scores sign-in and user risk. Access reviews prune standing access.
- Practice with non-human identities. Workload identities, service principals, and managed identities are now core to Zero Trust identity questions because agentic AI made them everyday actors.
- Do not skip the CIA triad and defense-in-depth. Domain 1 always tests them, and they are free points once you can recognize the vocabulary.
Keep Practicing Zero Trust Identity
You just cleared the opening set of the SC-900 series. Zero Trust identity will keep resurfacing across every domain, so build the vocabulary early and you will thank yourself on exam day. For the official Microsoft-authored breakdown of the model, work through the free Microsoft Entra Conditional Access documentation alongside these questions.
When you are ready to widen your prep, jump into related sets on this site. Our AZ-900 identity, security, and network protection questions reinforce the same fundamentals from an Azure architect angle. If governance is where you need more reps, try the AZ-305 identity, governance, and monitoring set. And for the AI angle that made this trending topic urgent, our AI-102 generative AI questions pair naturally with today’s Zero Trust identity theme.
Come back tomorrow for SC-900 Questions 11-20, where we go deeper into Microsoft Entra capabilities. Keep practicing — one focused set a day beats a marathon every time.
