Zero Trust CNX-001 Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A global organization is replacing its legacy VPN and on-premises web security gateways with a cloud-delivered model. The goal is to provide secure access to SaaS applications and internal web apps for all users, regardless of location, while also enforcing data loss prevention (DLP) policies. Which framework best meets these requirements?

   • AA traditional hub-and-spoke VPN architecture that routes all traffic through a central data center for inspection.
   • BSecure Access Service Edge (SASE) that converges network connectivity and security functions into a single cloud service.
   • CA next-generation firewall (NGFW) deployed at each branch office with a central management console.
   • DA standalone cloud access security broker (CASB) that focuses only on monitoring and controlling SaaS application usage.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   When deploying a CASB in forward proxy mode, what is a typical requirement?

   • AThe CASB must be installed on each user's device.
   • BUsers' traffic must be routed through the CASB.
   • CThe CASB must be placed in the cloud provider's data center.
   • DThe CASB must be integrated with the cloud provider's API.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is evaluating SASE providers and wants to ensure that the solution can enforce consistent security policies for users accessing both web and SaaS applications. The security team needs a single policy engine that can apply rules across all traffic types. Which SASE component is most important for this requirement?

   • AA secure web gateway (SWG) that filters web traffic and blocks malicious websites.
   • BA high-performance SD-WAN edge device that can handle large amounts of traffic.
   • CA unified policy management console that allows administrators to define and enforce policies across all SASE functions.
   • DA cloud access security broker (CASB) that is specifically designed for SaaS applications.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   When deploying SASE, what is the typical approach to network connectivity for remote users?

   • ARemote users connect through a dedicated MPLS circuit.
   • BRemote users must first connect to the corporate VPN.
   • CRemote users connect directly to the SASE cloud via a secure tunnel.
   • DRemote users are not supported in a SASE deployment.
   Reveal Solution Discussion Select an answer first