Apply Automation and Orchestration ZERO-TRUST-DESIGN Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which action is most likely to be part of an automated incident response playbook aligned with Zero Trust principles?

   • ADeleting all logs related to the incident to preserve privacy.
   • BManually reviewing the incident report by a senior analyst.
   • CWaiting for the user to report the incident.
   • DAutomatically isolating a compromised endpoint from the network.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company uses a Zero Trust model where access decisions are based on user identity, device health, and location. They want to automatically revoke access when a device fails a compliance check. Which approach best implements this policy-driven automation?

   • AConfigure the identity provider to evaluate device compliance during each authentication request and deny access if the device is non-compliant.
   • BManually review device compliance reports weekly and revoke access for non-compliant devices.
   • CSet up a scheduled task that disables all user accounts at the end of each day and re-enables them in the morning.
   • DUse a firewall rule to block all traffic from devices that have not been patched in the last 30 days.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is an example of policy-driven automation enforcing a Zero Trust access decision?

   • AA user is automatically granted access to a resource if their device is compliant and their risk score is low.
   • BA firewall blocks all traffic from a specific IP address based on a static rule.
   • CA security analyst receives an alert and manually blocks a user's access.
   • DAn administrator manually reviews each access request and decides whether to grant access.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations team receives thousands of low-severity alerts daily from multiple sources. Analysts spend most of their shift manually deduplicating and categorizing these alerts before escalation. The team wants to reduce this manual effort without risking missed critical alerts. Which approach best addresses this need?

   • AIncrease the number of analysts on the team to manually process the same volume of alerts in parallel.
   • BImplement a SOAR platform that automatically resolves all alerts without human review.
   • CDisable all low-severity alerts so analysts only see high-severity ones.
   • DAutomate log collection and alert triage to enrich, deduplicate, and prioritize alerts based on severity and context before presenting them to analysts.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In a Zero Trust environment, which monitoring activity can be automated to reduce the workload on security analysts?

   • APerforming initial triage of alerts to filter out false positives.
   • BDetermining the root cause of a complex multi-stage attack.
   • CEvaluating the effectiveness of a new security awareness training program.
   • DDeciding the appropriate disciplinary action for a user who clicked a phishing link.
   Reveal Solution Discussion Select an answer first