Zero Trust CNX-001 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization uses several sanctioned SaaS applications (e.g., Salesforce, Office 365) and wants to enforce data loss prevention (DLP) policies on sensitive data shared within these apps. The security team needs visibility into user activities and the ability to block risky actions in real time. Which deployment model for a cloud access security broker (CASB) is most appropriate?

   • AForward proxy deployment that routes all user traffic to the SaaS applications through the CASB.
   • BReverse proxy deployment that sits in front of the SaaS applications and intercepts requests from all users.
   • CAPI-based deployment that connects directly to the SaaS applications' APIs to scan data at rest and enforce policies.
   • DLog collection from the SaaS applications' audit logs and manual review by the security team.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a common tool used to implement microsegmentation in cloud environments?

   • ACloud security groups and network policies.
   • BDNS filtering.
   • CPhysical network switches.
   • DLoad balancers.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which statement best describes a core principle of zero trust architecture?

   • AAccess decisions are based on the identity and posture of the user and device, regardless of network position.
   • BAll users inside the corporate network are automatically trusted.
   • CTrust is established based on the network location of the user's device.
   • DAccess is granted based on the user's role alone, without considering device security.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In a zero trust framework, what is the primary purpose of continuous verification?

   • ATo reduce the need for multi-factor authentication.
   • BTo ensure that trust is never assumed based on a single authentication event.
   • CTo replace the need for identity management systems.
   • DTo eliminate the need for monitoring user activity.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a primary function of a Cloud Access Security Broker (CASB)?

   • ATo manage on-premises network infrastructure.
   • BTo provide a VPN for remote users.
   • CTo monitor and secure the use of cloud services.
   • DTo replace the need for identity providers.
   Reveal Solution Discussion Select an answer first