Zero Trust CNX-001 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a key capability of a CASB?

   • AData loss prevention (DLP) for cloud applications.
   • BFirewall rule management.
   • CNetwork routing optimization.
   • DHardware inventory management.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A multinational company is deploying SASE to provide secure access to cloud services for all employees. The network team must ensure that traffic from branch offices is securely connected to the SASE provider without backhauling through the corporate data center. Which component of the SASE architecture is essential for this requirement?

   • AA next-generation firewall (NGFW) installed at each branch office with a site-to-site VPN to the cloud provider.
   • BA cloud access security broker (CASB) that is deployed only in the corporate data center.
   • CA central VPN concentrator in the corporate data center that all branch traffic must traverse.
   • DSD-WAN edge devices at each branch that establish secure tunnels directly to the SASE points of presence (PoPs).
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary function of Zero Trust Network Access (ZTNA)?

   • ATo replace firewalls with a software-defined perimeter that allows all traffic.
   • BTo monitor network traffic for anomalies without controlling access.
   • CTo enforce strict identity verification for every person and device before granting access to applications.
   • DTo provide a VPN-like tunnel that grants broad network access once authenticated.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a key characteristic of the SASE framework?

   • AIt focuses only on securing data at rest.
   • BIt is a single security product that replaces all other security tools.
   • CIt is delivered as a cloud service from points of presence (PoPs) worldwide.
   • DIt requires hardware appliances in each branch office.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is implementing microsegmentation in its data center to protect a critical application. The security team wants to ensure that the application's web servers can only communicate with the application's database servers, and that no other workloads can access the database. Which microsegmentation technique should be used?

   • APlace the web and database servers in the same VLAN and rely on the application's built-in authentication to protect the database.
   • BConfigure a firewall rule that allows traffic from the web server IP addresses to the database server IP addresses on all ports.
   • CCreate a security group for the web servers and a security group for the database servers, then define a rule that allows traffic from the web server group to the database server group on the required port.
   • DUse a network access control (NAC) solution to authenticate the web servers before they can access the database.
   Reveal Solution Discussion Select an answer first