Zero Trust: Never Trust, Always Verify | Guided by A Guide to Cloud

What is Zero Trust?

Simple explanation

Imagine a building where everyone shows ID at every door — not just the front entrance.

The old security model was like a castle with a moat: once you got past the front gate (the corporate firewall), you were trusted everywhere. Walk freely, open any office, access any file.

Zero Trust says: no. Every door checks your ID. Every time. Even if you just walked through the door next to it. Even if you work here. Even if you’ve been here for 20 years.

Why? Because threats come from inside too. A stolen password, a compromised laptop, a disgruntled employee — if they’re already “inside,” the old model can’t stop them.

The three core principles

These three principles appear in nearly every security question on the exam:

Principle	What It Means	Example
Verify explicitly	Always authenticate and authorise based on all available data points	Check the user’s identity, device health, location, AND the sensitivity of what they’re accessing
Use least privilege access	Give only the minimum permissions needed, for only as long as needed	Sam gives Tina “store manager” access, not “global admin.” Elevated access expires after 4 hours.
Assume breach	Design systems as if an attacker is already inside	Segment networks, encrypt data, monitor for anomalies, limit blast radius

Exam tip: recognising Zero Trust principles in questions

The exam often describes a scenario and asks “which Zero Trust principle does this follow?”

Pattern recognition:

If the answer involves checking multiple factors before granting access → Verify explicitly
If the answer involves limiting permissions or time-bound access → Least privilege
If the answer involves monitoring, segmentation, or encryption → Assume breach

Sometimes questions combine principles: “Check device compliance (verify explicitly) and grant read-only access for 2 hours (least privilege).”

Zero Trust vs the old model

Why Zero Trust replaced the traditional model
Feature	Zero Trust	Traditional (Castle-and-Moat)
Trust model	Never trust, always verify	Trust everything inside the network
Network location	Not a factor in trust decisions	Inside = trusted, outside = untrusted
Access control	Least privilege, just-in-time	Broad access once authenticated
Verification	Continuous — every request	Once — at the perimeter
Breach assumption	Designs for breach from day one	Assumes perimeter will hold
Remote work	Works perfectly — location doesn't matter	Requires VPN to 'get inside'

The six pillars of Zero Trust

Microsoft implements Zero Trust across six areas. Think of each pillar as a door that checks your ID independently:

Pillar	What It Covers	Microsoft Service
Identity	Users, service accounts, devices requesting access	Microsoft Entra ID (MFA, Conditional Access)
Devices	Device health and compliance	Intune, Defender for Endpoint
Applications	App permissions and shadow IT	Defender for Cloud Apps, app consent policies
Data	Data classification and protection	Microsoft Purview (labels, DLP, encryption)
Infrastructure	Server and cloud resource security	Microsoft Defender for Cloud, secure configurations
Network	Network segmentation and monitoring	Azure Firewall, NSGs, Global Secure Access

Scenario: Sam implements Zero Trust at BrightStar

Sam decides BrightStar Retail needs proper security. Here’s how Zero Trust applies:

Identity: All 50 employees use MFA — even in the store
Devices: Only company-managed tablets and laptops can access inventory data
Applications: Employees can’t install random apps that connect to company data
Data: Customer payment information is encrypted and labelled “Confidential”
Infrastructure: The POS system runs on a separate network segment
Network: Store Wi-Fi for customers is completely isolated from the business network

The result: When a phishing email compromises Tina’s password, MFA blocks the attacker. Even if they bypass MFA, they can only access Tina’s store-manager resources — not the financial system.

Common Zero Trust misconceptions

Misconception	Reality
”Zero Trust means zero access”	No — it means verified access, not no access
”It’s a single product you buy”	No — it’s a strategy applied across products and services
”It replaces firewalls”	No — firewalls are one layer within Zero Trust (the network pillar)
“Only for big enterprises”	No — even a 50-person business like BrightStar can implement it

🎬 Video walkthrough

🎬 Video coming soon

Zero Trust Explained — SC-900 Module 2

~8 min

Flashcards

Question

What are the three core Zero Trust principles?

Click or press Enter to reveal answer

Answer

1) Verify explicitly — always authenticate using all available signals. 2) Use least privilege access — minimum permissions, minimum time. 3) Assume breach — design as if an attacker is already inside.

Click to flip back

Question

What are the six pillars of Zero Trust?

Click or press Enter to reveal answer

Answer

Identity, Devices, Applications, Data, Infrastructure, Networks. Each pillar is an independent checkpoint — securing one doesn't replace securing the others.

Click to flip back

Question

How does Zero Trust differ from the traditional castle-and-moat model?

Click or press Enter to reveal answer

Answer

Traditional: trust everything inside the network. Zero Trust: trust nothing, verify everything — regardless of location. Every request is treated as if it comes from an untrusted network.

Click to flip back

Knowledge Check

Knowledge CheckSelect all that apply

Raj at Lakewood University needs to give Professor Chen temporary admin access to set up a new course site. The access should expire automatically after 48 hours. Which TWO Zero Trust principles does this demonstrate? (Select 2)

Knowledge Check

Sam wants to ensure that even if an employee's password is stolen, an attacker cannot access BrightStar's inventory system. Which Zero Trust principle should Sam prioritise?