1.8 Describe Zero Trust Architecture 350-701 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is implementing zero trust. They have successfully deployed MFA and device compliance checks. However, they are struggling with the 'data' pillar. They have data spread across on-premises file servers, cloud storage, and SaaS applications. They need to classify and protect this data, but they are unsure where to start. What is the most practical first step?

   • AEncrypt all data at rest using a single enterprise-wide encryption key management solution.
   • BImplement strict access controls on the on-premises file servers, as they hold the most sensitive data.
   • CDeploy a data loss prevention (DLP) solution across all endpoints and cloud services to monitor data in motion and at rest.
   • DConduct a data discovery and classification project to identify sensitive data, its location, and its owner.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is deploying a zero trust architecture using a software-defined perimeter (SDP) approach. The SDP controller authenticates the user and device, and then dynamically creates a connection to the application server. In this model, which component acts as the policy enforcement point (PEP)?

   • AThe application server itself, which hosts the application and data.
   • BThe user's device agent, which initiates the connection request.
   • CThe SDP controller, which makes the decision to allow or deny access.
   • DThe SDP gateway, which sits in the data path and forwards traffic to the application server after the controller grants access.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is planning a zero trust implementation. They have a mature identity platform (SSO/MFA) but a very flat network with no segmentation. Their primary security goal is to reduce the blast radius of a compromised endpoint. They have a limited budget and cannot afford a major network redesign this year. Which approach best balances their goal with their constraints?

   • ADeploy a new next-generation firewall at the internet edge and rely on it to block all malicious traffic.
   • BBegin a multi-year project to implement micro-segmentation across the entire data center using a new SDN controller.
   • CImplement a zero trust network access (ZTNA) solution that provides per-application access, hiding applications from the network and enforcing policy at the application layer.
   • DRequire all users to use a VPN for all traffic, even when on the corporate network.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which zero trust deployment model focuses on creating isolated security zones within the network to limit lateral movement?

   • AEnhanced identity
   • BMicro-segmentation
   • CNetwork infrastructure
   • DZero trust network access (ZTNA)
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is replacing its legacy perimeter-based security model. Currently, any user on the corporate LAN can reach the internal file server without authentication, relying on the firewall to keep attackers out. The security team wants to adopt a zero trust approach. Which change best reflects the core principle of zero trust?

   • ADeploy a more powerful next-generation firewall at the internet edge to inspect all inbound and outbound traffic.
   • BRequire multi-factor authentication for every user and device attempting to access the file server, regardless of their location.
   • CCreate a VPN for remote users so they can access the file server as if they were on the corporate LAN.
   • DMove the file server to a public cloud provider so it is no longer on the internal LAN.
   Reveal Solution Discussion Select an answer first