A security model that trusts nothing by default, not even what is inside the corporate network. It is based on three principles: verify every request explicitly, use least privilege access, and assume a breach already exists.
In SC-900 it is the foundation of domain 1. The six pillars where controls apply are identities, devices, applications, data, infrastructure, and networks. Typical question: segmenting the network and encrypting end to end maps to "assume breach"; evaluating location, device, and risk before each access maps to "verify explicitly".
Zero Trust is a concept that can show up on the exam. Check the full guide to see it in context.