Zero Trust CNX-001 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial institution wants to limit lateral movement within its data center. The security team plans to isolate the web application tier from the database tier, allowing only the web servers to communicate with the database servers on a specific port. Which microsegmentation approach should they use?

   • AImplement distributed firewall rules within the hypervisor that are attached to each virtual machine's virtual NIC.
   • BConnect the web and database servers to different physical switches and configure port security on each switch port.
   • CPlace the web and database servers in separate VLANs and rely on the existing core switch's access control lists (ACLs).
   • DUse a traditional firewall in front of the database tier and create a rule that allows traffic from the web server's IP address.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a primary benefit of deploying a SASE solution for cloud service access?

   • AIt provides secure and efficient access by applying security policies at the edge.
   • BIt only works with a single cloud provider.
   • CIt requires all traffic to be backhauled to a central data center.
   • DIt eliminates the need for any security controls.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What does the Secure Access Service Edge (SASE) framework primarily integrate?

   • ANetwork security functions with wide-area network (WAN) capabilities.
   • BFirewall and antivirus into a single appliance.
   • COn-premises data centers with public cloud storage.
   • DIdentity management with endpoint detection and response.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An organization is adopting zero trust principles and wants to implement microsegmentation. The security team is debating whether to use a 'default deny' policy or a 'default allow' policy with exceptions. The goal is to minimize the risk of lateral movement while maintaining operational efficiency. Which approach is more aligned with zero trust?

   • ADefault deny, which blocks all traffic unless explicitly allowed by a policy.
   • BDefault allow for internal traffic and default deny for external traffic.
   • CDefault allow, which permits all traffic and then adds blocks for known malicious traffic.
   • DDefault deny for new workloads and default allow for existing workloads.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A large enterprise is implementing microsegmentation across its hybrid cloud environment, which includes virtualized workloads in a private cloud and containers in a public cloud. The security team needs a single tool that can enforce consistent security policies across both environments. Which tool should they consider?

   • AA cloud-native security platform that provides microsegmentation for virtual machines and containers through a centralized policy management console.
   • BA network access control (NAC) solution that authenticates devices before they connect to the network.
   • CA host-based firewall on each server that is manually configured by the server administrators.
   • DA traditional network firewall with VLAN-based segmentation rules.
   Reveal Solution Discussion Select an answer first