Security, Compliance and Identity Concepts · Topic 2 of 3
Zero Trust, Encryption and GRC
SC-900 Zero Trust, encryption and GRC: the three Zero Trust principles, symmetric and asymmetric encryption, hashing, and governance, risk and compliance defined.
- 5 min
- Zero Trust has three principles: verify explicitly, use least privilege access, assume breach.
- Symmetric encryption uses one key. Asymmetric uses a public and private pair.
- Hashing is one way and is used for integrity and password storage.
What it is
Three ideas in this topic shape most security design today. Zero Trust is a model that trusts no request by default. Encryption and hashing protect data and prove it has not changed. Governance, risk and compliance is the management side, which sets the rules, measures the danger and shows the rules are met.
How it works
The Zero Trust model
Older security assumed that anything inside the company network was safe. Zero Trust drops that assumption, because attackers can get inside and people work from anywhere. Its guiding idea is "never trust, always verify". It rests on three principles.
| Principle | Meaning |
|---|---|
| Verify explicitly | Check every request using all available signals, such as user, location, device health and risk |
| Use least privilege access | Give only the access needed, and only for as long as needed |
| Assume breach | Design as if an attacker is already inside, to limit damage and detect it fast |
Zero Trust applies across six areas, called pillars: identities, endpoints, applications, data, infrastructure and network. Microsoft Entra Conditional Access, Microsoft Defender and network segmentation are all ways to put these ideas into practice.
Encryption
Encryption turns readable data, called plaintext, into unreadable ciphertext with a key, and only the right key turns it back.
- Symmetric encryption uses one shared secret key to encrypt and decrypt. It is fast, so it protects large amounts of data. The challenge is sharing the key safely.
- Asymmetric encryption uses a pair of keys. The public key encrypts and can be shared widely. Only the matching private key can decrypt. It is slower, so it is often used to exchange a symmetric key.
Encryption is applied in two places.
| State | Meaning | Example |
|---|---|---|
| At rest | Data stored on a disk or in a database | Encrypted storage account or database |
| In transit | Data moving over a network | HTTPS and TLS |
Hashing and digital signatures
Hashing runs data through a function that produces a fixed length value, called a hash. It is one way: you cannot turn the hash back into the data. Hashing is used to check integrity, because changing even one character of the data changes the hash. It is also how systems store passwords without keeping the passwords themselves.
A digital signature uses a key pair to prove who sent data and that it has not been altered. The sender signs with the private key, and anyone can check it with the public key.
Governance, risk and compliance
| Term | Meaning |
|---|---|
| Governance | The rules, policies and processes that direct how an organisation is run and secured |
| Risk | The chance that something harmful happens, and how bad it would be |
| Compliance | Meeting laws, regulations and standards, and being able to show it |
Governance sets the direction. Risk management finds and reduces threats. Compliance proves that the organisation follows the required rules. Together they are called GRC.
A worked scenario
A bank moves to a Zero Trust approach. Every login is checked against the user's location, device health and sign in risk, which is verify explicitly. Staff get only the roles their job needs, and temporary access for sensitive tasks, which is least privilege. The bank also encrypts its databases at rest and uses TLS in transit, and stores customer passwords only as hashes. Auditors then ask for evidence that these controls follow the bank's policies and regulations, which is compliance.
The six Zero Trust pillars with Microsoft tools
| Pillar | What is protected | Example tool |
|---|---|---|
| Identities | Users, services and devices as accounts | Microsoft Entra ID, multifactor authentication |
| Endpoints | Laptops, phones and servers | Microsoft Defender for Endpoint, Intune |
| Applications | Software and the data they use | Defender for Cloud Apps |
| Data | Files, emails and databases | Microsoft Purview, encryption |
| Infrastructure | Servers, containers and cloud resources | Defender for Cloud |
| Network | Traffic between all of the above | Network segmentation, Azure Firewall |
Encryption in everyday Azure use
Most Azure storage encrypts data at rest by default, so the data on the disk is unreadable without the key. Connections to web services use HTTPS, which relies on TLS to protect data in transit. A customer can keep its own keys in Azure Key Vault when it needs more control over who can unlock the data.
Seeing why a hash changes
If you hash the word Password and then the word password, you get two completely different values, because even a one letter change alters the whole result. That property is why a hash can show that a file has not been tampered with. A system that stores only the hash of a password can check a sign in by hashing what the user types and comparing the two values.
GRC in practice
| Part | A practical example |
|---|---|
| Governance | A policy that every administrator account must use multifactor authentication |
| Risk | A register that lists threats, for example stolen credentials, with their likelihood and impact |
| Compliance | Audit evidence showing that the policy is applied and the regulation is met |
What to remember for the exam
- Zero Trust has three principles: verify explicitly, use least privilege access, assume breach.
- Symmetric encryption uses one key. Asymmetric uses a public and private pair.
- Hashing is one way and is used for integrity and password storage.
- A digital signature proves origin and integrity.
- GRC stands for governance, risk and compliance.
Do not call hashing encryption. Encryption can be reversed with a key. A hash cannot be reversed.
How the exam asks about this
- "Never trust, always verify." Zero Trust.
- "Which encryption uses the same key to lock and unlock?" Symmetric.
- "Protect data stored on disk." Encryption at rest.
- "Which process shows the organisation follows laws and standards?" Compliance.
Common mistakes
Believing Zero Trust is a single product. It is a model that many products help to implement.
Mixing up the public and private key. The public key can be shared. The private key must stay secret.
Thinking a hash can be decrypted. It is one way by design.
Confusing governance with compliance. Governance sets the rules. Compliance shows the rules are followed.
Check yourself
Which three principles make up Zero Trust?
Verify explicitly, use least privilege access, and assume breach.
What is the difference between symmetric and asymmetric encryption?
Symmetric uses one shared key. Asymmetric uses a public and private key pair.
Why is a hash used to store passwords?
It is one way, so the original password cannot be recovered from it.
Topic 2 of 3 in Security, Compliance and Identity Concepts
Test yourself on Security, Compliance and Identity Concepts
The full Microsoft SC-900 question bank has 503 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.