MCRA Zero Trust Methodology Drag and Drop

SC-100 By islever Editorial Last updated

Design solutions that align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB)

Short answer

Under 'Assume Breach': Business continuity. Under 'Verify Explicitly': Data classification. Under 'Use least privilege access': Just-in-time (JIT).

Question

29 DRAG DROP
For a Microsoft cloud environment, you need to recommend a security architecture that follows the Zero Trust principles of the Microsoft Cybersecurity Reference Architectures (MCRA).
Which security methodologies should you include in the recommendation? To answer, drag the appropriate methodologies to the correct principles. Each methodology may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Exhibit: MCRA Zero Trust Methodology Drag and Drop

Key Takeaways

The common trap is confusing general security concepts with the specific MCRA mappings; you must match Business Continuity to Assume Breach, Data Classification to Verify Explicitly, and JIT to Least Privilege.

This SC-100 exam question tests your ability to map Microsoft Cybersecurity Reference Architecture (MCRA) security methodologies to the core Zero Trust principles. The correct alignment relies on understanding how specific controls enforce 'Assume Breach', 'Verify Explicitly', and 'Use Least Privilege'.

Common mistake: Learners often incorrectly associate 'Segmenting Access' with 'Assume Breach' because segmentation helps contain breaches, but in the MCRA framework, it is explicitly mapped to 'Least Privilege'. Similarly, 'Business Continuity' is often overlooked for 'Assume Breach'.

Expert Analysis

Why the Answer Is Correct

The Microsoft Cybersecurity Reference Architecture (MCRA) explicitly maps security methodologies to Zero Trust principles to ensure comprehensive coverage. Business Continuity is mapped to Assume Breach, reflecting the strategy that an attack will happen and operations must continue. Data Classification is mapped to Verify Explicitly, as knowing what data you are protecting allows for precise authentication and authorization checks. Just-in-Time (JIT) access is mapped to Use Least Privilege Access, ensuring users only have access when strictly necessary.

Why Other Candidate Answers Are Wrong

Candidates like 'Segmenting Access' are often mistakenly placed under 'Assume Breach'. While segmentation aids containment, the MCRA specifically aligns it with Least Privilege Access by limiting lateral movement. 'Always Available' or generic availability metrics do not fit the strict definitions of these three core principles in the context of the MCRA slide deck.

Community Comment Notes

Community consensus strongly supports this mapping, with multiple users citing Slide 31 or Page 31 of the official MCRA PowerPoint as proof. One user noted, "Segmenting access is an important methodology for implementing a least privileged access approach," confirming the link between segmentation and least privilege. Another user highlighted that "Business continuity... enforcing Principle 1: Assume Breach" is the key insight for the first category.

Official Reference

https://www.microsoft.com/en-us/security/business/zero-trust

This link opens the official vendor documentation in a new tab.

Exam Strategy

When studying for SC-100, memorize the specific pairings in the MCRA matrix rather than just general Zero Trust concepts. Focus on the 'Why': Why does Business Continuity relate to Assuming Breach? Because you plan for failure. Why does Data Classification relate to Verification? Because you verify based on data sensitivity.

Frequently Asked Questions

Why is Business Continuity linked to Assume Breach?

Because assuming a breach means planning for inevitable attacks; business continuity ensures operations survive such events.

Is Segmenting Access part of Least Privilege?

Yes, in the MCRA framework, segmenting access limits lateral movement, which is a key aspect of enforcing least privilege.

More SC-100 FAQ →

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. Baz10 👍 6
    On Exam 8 Apr 2024 scored 764 1. Segmenting access 2. Data classification 3. JIT access
  2. Jame 👍 4
    I think Answer is correct. https://www.microsoft.com/en-us/security/business/zero-trust Zero Trust principles Verify explicitly Always authenticate and authorize based on all available data points, including user identity, location, device health, service or workload, data classification, and anomalies. Use least-privilege access Limit user access with just-in-time and just-enough-access (JIT/JEA), risk-based adaptive polices, and data protection to help secure both data and productivity. Assume breach Minimize blast radius and segment access. Verify end-to-end encryption and use analytics to get visibility, drive threat detection, and improve defenses.
  3. God2029 👍 4
    Segmentation will contain the breach with the specific instance - This will help to isolate the breach. Enforcing Principle 1 : Assume Breach Data Classification helps to determine the most sentive data and labeling them, enforcing RBAC based access control on the data will help to enforce the Principle 2 Verify Explicitly. Finally JIT is providing access based on time period, Enforcing the 3rd in the list, Principles of Least Previlage
  4. Ceuse 👍 3
    Answer Looks Good : https://www.microsoft.com/en-us/security/business/zero-trust Zero Trust principles Verify explicitly Always authenticate and authorize based on all available data points, including user identity, location, device health, service or workload, data classification, and anomalies. Use least-privilege access Limit user access with just-in-time and just-enough-access (JIT/JEA), risk-based adaptive polices, and data protection to help secure both data and productivity. Assume breach Minimize blast radius and segment access. Verify end-to-end encryption and use analytics to get visibility, drive threat detection, and improve defenses.
  5. PrettyFlyWifi 👍 3
    Slide 20 of the MCRA, answer looks correct!
Show 8 more comments
  1. SunilB 👍 2
    1. Assume breach Business continuity (Plan as if an attack will happen and ensure operations can continue.) 2. Verify explicitly Data classification (Know what data you’re protecting so verification can be enforced.) 3. Use least privilege access Just‑in‑time (JIT) (Give access only when needed.)
  2. alessag 👍 2
    I don't think it is correct because slide #31 doesn't mention Business continuity, but business enablement. It is a bit different. Question is: please help me to understand why do you think behind enablement = business continuity?
  3. cris_exam 👍 2
    Answer seems correct. Slide 31 of the MCRA. https://github.com/MicrosoftDocs/security/blob/main/Downloads/mcra-december-2023.pptx?raw=true
  4. Ario 👍 2
    Segmenting access is an important methodology for implementing a least privileged access approach within a Zero Trust architecture
  5. Lapatiser 👍 2
    From page 31 of MCRA, correct answer is: Business continuity Segmenting Access Just-in-time (JIT)
  6. Reevs 👍 1
    Assume breach > Segmenting access • Reasoning: The "Assume breach" principle focuses on minimizing the blast radius of an attack and preventing lateral movement. This is primarily achieved by segmenting access across network layers, users, devices, and application boundaries. Verify explicitly > Data classification Reasoning: The "Verify explicitly" principle requires continuous authentication and authorization using all available telemetry points. This explicitly includes utilizing data classification to dynamically understand the sensitivity of the data being accessed and apply relevant conditional controls. Use least privilege access > Just-in-time (JIT) access • Reasoning: The "Least privilege" principle requires restricting user privileges to only what is necessary for their job functions. This is directly enforced using Just-in-time (JIT) access and Just-Enough-Access (JEA) models to grant elevated permissions temporarily and revoke them immediately after use.
  7. Er_01 👍 1
    1 - segment access - assume breach means contain attacker 2- JIT - slide 31 JIT / JEA under explicit and least privileged. The issue is they left out JEA as an option but per slide 31 it infers both. Misleading question that requires more clarity and accuracy for such a fundamental concept.
  8. emartiy 👍 1
    I have checked MCRA presentation (Pages 31-32) Source: aka.ms/MCRA(Download presentation file from link bottom of page on the link aka) 1-Business continuity - Assume breach 2 -Segmenting - Verify explicitly 3 -Just-intime (JIT) - Use least privilege access

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Microsoft Entra Permissions Management to find unused RBAC assignments

S-grade

Scenarios supported by compliant network check in Global Secure Access

S-grade

Removing the inbound firewall rule for an Entra application proxy connector

S-grade

Changing DNS MX records to route all inbound mail through Defender for Office 365

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide