SC-100 Certification Practice Question #22

Question

You have an on-premises network and a Microsoft 365 subscription.

You are designing a Zero Trust security strategy.

Which two security controls should you include as part of the Zero Trust solution? Each correct answer presents part of the solution.

NOTE: Each correct answer is worth one point.

Accepted Answer

Zero Trust validates trusted signals — user, location, and device compliance — before granting access. MS Learn's Conditional Access and Zero Trust guidance explicitly lists "block or grant access from specific locations" (matches C) and using device compliance state to "block access to organizational resources from that device" (matches D) as core controls. Option A directly violates the "assume breach / never trust" principle by unconditionally trusting the on-premises network, and option B is the opposite of best practice because Microsoft prioritizes MFA and passwordless authentication, not its removal. The official Suggested Answer (D), the dominant community vote (CD, 16), and the highest-voted comment all converge, so confidence is high.

More SC-100 practice questions