A social services casework office uses the Zero Trust "assume breach" mindset when reviewing lateral movement risks in the city Microsoft 365 tenant. What does that principle emphasize?

A social services casework office using Zero Trust ‘assume breach’ when reviewing lateral movement risk designs controls as if an attacker may already have a foothold, so containment, segmentation, least privilege, detection, and continuous verification still matter after initial authentication. One successful sign-in is not a forever trust ticket across the city Microsoft 365 tenant.

The option about evaluating case file requests using identity and device health signals before granting access to city caseworkers accurately describes verify explicitly, but it addresses how each request is authenticated, not how the tenant assumes an attacker already has a foothold. The option about scoping caseworker permissions to current assignments for handling social benefit casework in the city tenant accurately describes least privilege, which is a different pillar from assuming compromise and designing containment around it. The option about deploying layered independent safeguards across the tenant to protect city casework data from control failures accurately describes defense in depth, but layering safeguards is a distinct idea from the assume-breach mindset of planning as though one of those layers has already failed.

Exam caveat: Assume breach complements evaluating case file requests using identity and device health signals and scoping caseworker permissions to current assignments for handling social benefit casework. Correct answers emphasize continuous control and containment; wrong answers remove monitoring or access policies.

Operational check: review privileged roles and app permissions for casework workloads, ensure Conditional Access and session controls remain enabled, verify audit logging covers mailbox, SharePoint, and Entra sign-ins, practice isolating a suspect account, and confirm social-services admins can detect unusual lateral access patterns without disabling protective controls for convenience.