MCRA Zero Trust Methodology Drag and Drop
29 DRAG DROP
For a Microsoft cloud environment, you need to recommend a security architecture that follows the Zero Trust principles of the Microsoft Cybersecurity Reference Architectures (MCRA).
Which security methodologies should you include in the recommendation? To answer, drag the appropriate methodologies to the correct principles. Each methodology may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Community Insight
The common trap is confusing general security concepts with the specific MCRA mappings; you must match Business Continuity to Assume Breach, Data Classification to Verify Explicitly, and JIT to Least Privilege.
This SC-100 exam question tests your ability to map Microsoft Cybersecurity Reference Architecture (MCRA) security methodologies to the core Zero Trust principles. The correct alignment relies on understanding how specific controls enforce 'Assume Breach', 'Verify Explicitly', and 'Use Least Privilege'.
Learners often incorrectly associate 'Segmenting Access' with 'Assume Breach' because segmentation helps contain breaches, but in the MCRA framework, it is explicitly mapped to 'Least Privilege'. Similarly, 'Business Continuity' is often overlooked for 'Assume Breach'.
Community Discussion (13 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The Microsoft Cybersecurity Reference Architecture (MCRA) explicitly maps security methodologies to Zero Trust principles to ensure comprehensive coverage. Business Continuity is mapped to Assume Breach, reflecting the strategy that an attack will happen and operations must continue. Data Classification is mapped to Verify Explicitly, as knowing what data you are protecting allows for precise authentication and authorization checks. Just-in-Time (JIT) access is mapped to Use Least Privilege Access, ensuring users only have access when strictly necessary.Why Other Candidate Answers Are Wrong
Candidates like 'Segmenting Access' are often mistakenly placed under 'Assume Breach'. While segmentation aids containment, the MCRA specifically aligns it with Least Privilege Access by limiting lateral movement. 'Always Available' or generic availability metrics do not fit the strict definitions of these three core principles in the context of the MCRA slide deck.Community Comment Notes
Community consensus strongly supports this mapping, with multiple users citing Slide 31 or Page 31 of the official MCRA PowerPoint as proof. One user noted, "Segmenting access is an important methodology for implementing a least privileged access approach," confirming the link between segmentation and least privilege. Another user highlighted that "Business continuity... enforcing Principle 1: Assume Breach" is the key insight for the first category.Official Reference
Exam Strategy
When studying for SC-100, memorize the specific pairings in the MCRA matrix rather than just general Zero Trust concepts. Focus on the 'Why': Why does Business Continuity relate to Assuming Breach? Because you plan for failure. Why does Data Classification relate to Verification? Because you verify based on data sensitivity.
Frequently Asked Questions
Why is Business Continuity linked to Assume Breach?
Because assuming a breach means planning for inevitable attacks; business continuity ensures operations survive such events.
Is Segmenting Access part of Least Privilege?
Yes, in the MCRA framework, segmenting access limits lateral movement, which is a key aspect of enforcing least privilege.
Related Analysis
Practice All SC-100 Questions
Access 110 questions with complete answers and detailed explanations.
View Full SC-100 Practice Test →