Microsoft Cybersecurity Architect (SC-100)Design a Zero Trust strategy and architectureEasy
A global financial services company is designing a Zero Trust architecture for its critical trading platforms, which handle extremely sensitive transaction data. The architecture must ensure that even if an attacker compromises a user's credentials or device, they cannot gain unauthorized access to the trading platform's backend systems or data. Access must be granted only to specific, authorized services and always based on the principle of least privilege. Which Zero Trust principle is being emphasized by this requirement?
- AAssume Breach
- BUse Least Privilege
- CVerify Explicitly
- DMicro-segmentation
Show answer & explanationAnswer & explanation
Correct answer: B. Use Least Privilege
The requirement to grant access 'only to specific, authorized services' and 'always based on the principle of least privilege' directly emphasizes the Zero Trust principle of 'Use Least Privilege', which limits access rights to the bare minimum needed for a user or system to perform its function.
Why the other options are wrong
- A. Assume Breach is a mindset that assumes a breach will eventually occur, focusing on detection and response, not directly on limiting access itself.
- C. Verify Explicitly requires all access requests to be authenticated and authorized based on all available data points, but 'least privilege' is a specific outcome of this verification.
- D. Micro-segmentation is a network strategy to isolate workloads, which supports least privilege but is not the principle itself.
Use Least Privilege (Zero Trust)
The Zero Trust principle of 'Use Least Privilege' mandates that every user, device, and application should be granted only the minimum necessary permissions to perform its required task, for the shortest possible duration.
- Minimizes the attack surface and potential damage from a breach.
- Limits lateral movement for attackers.
- Requires just-in-time and just-enough access.
Memory trick: The Zero Trust Trio: 'Verify, Least, Assume'.