Describe security and compliance concepts
Objective security.compliance-concepts sits in Describe concepts of security, compliance, and identity, which carries 12% of the SCI Fundamentals exam. The questions below are original, written from the official objective title above, and each explanation cites the Microsoft Azure page it rests on.
Objective title verbatim from the official objectives. Microsoft Azure exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A company redesigns its access strategy so that no device or user is trusted by default, even when connected to the internal corporate network, and every access request is authenticated and authorized using all available signals. Which Zero Trust guiding principle does this describe?
The concept
Zero Trust is built on three guiding principles: verify explicitly, use least privilege, and assume breach, which Conditional Access helps enforce.
Why this answer
Authenticating and authorizing every request based on all available data points, regardless of network location, is the definition of the verify explicitly principle.
- Correct: this matches authenticating based on all available signals rather than trusting network location.
- BLeast privilege is about limiting access rights and duration, not about validating every request with signals.
- CAssume breach is about designing to limit damage after a compromise, not about validating requests up front.
- DZero Trust explicitly moves away from relying on network perimeter defense as the security boundary.
- ESingle sign-on is an authentication convenience feature, not one of the three Zero Trust guiding principles.
Now you: objective security.compliance-concepts questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A team moves a workload from its own datacentre to a SaaS application. Which responsibility stays with the customer regardless of the service model chosen?
Sample question 2 of 3
A security design assumes attackers may already be operating inside the network, and focuses on limiting how far an intrusion can spread. Which Zero Trust principle is being applied?
Sample question 3 of 3
Under Zero Trust, a session that was permitted an hour ago is evaluated again as conditions change. What does that continuous evaluation replace?
Full SCI Fundamentals question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.