Apply Hybrid Zero Trust ZERO-TRUST-DESIGN Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company uses a hybrid infrastructure with on-premises Active Directory and cloud-based SaaS applications. They want to enforce least-privilege access and require MFA for all administrative actions. What should they do?

   • AImplement a cloud identity provider and synchronize on-premises identities, then configure conditional access policies to require MFA for admins and assign just-in-time privileged roles.
   • BGrant all administrators permanent full access to all resources and rely on MFA only for external access.
   • CKeep on-premises Active Directory as the sole identity source and manually create separate accounts in each SaaS application.
   • DUse a federation service to allow SSO but do not enforce MFA for administrative accounts.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary challenge when enforcing consistent Zero Trust policies across on-premises, cloud, and edge resources?

   • AEnsuring that all resources use the same operating system
   • BEliminating all on-premises infrastructure to simplify policy enforcement
   • CConfiguring each environment with its own unique security policies to meet local requirements
   • DMaintaining a single source of truth for policies that can be applied uniformly across heterogeneous environments
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An organization has an existing SIEM and endpoint detection and response (EDR) tool. They are adopting Zero Trust and want to use these tools to support continuous verification. What is the best way to leverage them?

   • AUse the SIEM only for compliance reporting and the EDR only for malware detection.
   • BReplace the SIEM and EDR with a single cloud-native security platform.
   • CKeep the SIEM and EDR separate and rely on manual reviews of their alerts.
   • DIntegrate the SIEM and EDR with identity and access management (IAM) to share risk signals and trigger conditional access policies.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has sensitive data in on-premises file servers and cloud storage. They need to enforce data classification and prevent unauthorized access, but they also want to allow external partners to access specific files. What is the best approach?

   • AEncrypt all data and share encryption keys with external partners.
   • BCreate a separate network segment for external partners and give them access to all files in that segment.
   • CUse a single shared account for external partners to simplify management.
   • DUse a data classification tool to tag data, and apply access policies based on classification and user identity, including external partners with limited access.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is designing a Zero Trust architecture for a hybrid environment that includes an on-premises data center and a public cloud. They need to ensure that all access requests, regardless of location, are authenticated and authorized based on user identity and device posture. Which approach best aligns with Zero Trust principles?

   • AImplement a centralized identity provider (IdP) with conditional access policies that evaluate user identity, device compliance, and risk signals for every access request to both on-premises and cloud resources.
   • BDeploy a firewall at the network perimeter and allow all internal traffic to flow freely, assuming the internal network is trusted.
   • CUse a single sign-on (SSO) solution for all applications but skip multi-factor authentication (MFA) to reduce user friction.
   • DEstablish a VPN for remote users to access on-premises resources and rely on the cloud provider's native identity for cloud resources.
   Reveal Solution Discussion Select an answer first