Apply Hybrid Zero Trust ZERO-TRUST-DESIGN Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company has a hybrid network with on-premises and cloud workloads. They want to implement micro-segmentation but also need to maintain high availability and avoid complex manual rule management. Which approach is most suitable?

   • AUse a single flat network and rely on host-based firewalls for isolation.
   • BManually configure firewall rules on each workload and update them as needed.
   • CDeploy a traditional firewall at the network perimeter and segment only the DMZ.
   • DUse a software-defined networking (SDN) solution that supports micro-segmentation and automate policy updates through infrastructure-as-code.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization stores sensitive customer data in both on-premises databases and cloud object storage. They need to protect this data at rest and in transit, and also prevent unauthorized sharing. Which combination of controls is most appropriate?

   • AUse customer-managed keys for encryption but do not apply DLP because encryption is sufficient.
   • BStore all data in the cloud and rely on the cloud provider's default security settings.
   • CApply encryption at rest and in transit, and implement data loss prevention (DLP) policies to monitor and block unauthorized data transfers.
   • DEncrypt data at rest using platform-managed keys and rely on network security to protect data in transit.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A multinational company has on-premises Active Directory, cloud SaaS apps, and edge devices. They need to enforce consistent access policies but also comply with local privacy laws that restrict cross-border data transfers. What is the best approach?

   • AUse separate identity systems for each region and do not share any data.
   • BDeploy a single global identity provider and route all authentication traffic through a central data center.
   • CUse a distributed identity architecture with regional identity providers that synchronize only necessary attributes, and apply conditional access policies locally.
   • DRely on the cloud provider's global identity service and accept that data may be transferred.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A healthcare organization uses a hybrid environment with on-premises EHR systems and cloud-based analytics. They need to ensure that only authorized personnel can access patient data, and they want to automatically revoke access when an employee's risk score increases. Which solution is most effective?

   • AImplement a risk-based conditional access policy that integrates with identity governance and triggers automated access revocation when risk is detected.
   • BUse static role-based access control (RBAC) and require managers to manually revoke access when an employee leaves.
   • CDeploy a data loss prevention (DLP) tool and rely on it to block unauthorized access.
   • DUse a VPN for all access and trust that the network perimeter protects patient data.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which scenario best illustrates the use of orchestration in a hybrid Zero Trust environment?

   • AA configuration management tool that ensures all servers have the same patch level
   • BA script that regularly backs up data from on-premises servers to cloud storage
   • CAn automated playbook detects a compromised user account, revokes their access, and isolates the affected device across both on-premises and cloud systems
   • DA security analyst manually reviews logs and then manually blocks an IP address on the firewall
   Reveal Solution Discussion Select an answer first