Apply Identity Based Zero Trust ZERO-TRUST-DESIGN Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A manufacturing company wants to eliminate passwords for its factory floor workers who use shared kiosk computers. The workers need to log in quickly to access a production dashboard. The security team is concerned about phishing and credential theft. Which authentication mechanism best meets the requirement for passwordless access on shared devices?

   • ASMS one-time passcodes sent to each worker's personal mobile phone
   • BCertificate-based authentication using a certificate installed on each kiosk
   • CA shared PIN for the kiosk that all workers use to access the dashboard
   • DFIDO2 security keys that workers carry and tap on the kiosk to authenticate
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which signal is commonly evaluated by a conditional access policy?

   • AThe user's internet browser history
   • BThe user's favorite color
   • CThe user's location
   • DThe user's social media activity
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In identity-based Zero Trust, what does 'least privilege' mean?

   • AUsers must request access for every resource each time they need it
   • BUsers receive the same access level as their manager to simplify administration
   • CUsers are granted only the minimum access necessary to perform their job functions
   • DUsers are granted access to all resources but with additional monitoring
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An engineering firm uses a project management application. Project managers need full access to all projects, while engineers should only access projects they are assigned to. The identity team wants to enforce least privilege without manually updating permissions each time a project team changes. Which authorization model should they implement?

   • AA policy that grants all users access to all projects but logs all access for auditing
   • BRole-based access control (RBAC) with a single 'Engineer' role that grants access to all projects
   • CAttribute-based access control (ABAC) that grants access based on the user's department and project assignment attributes
   • DA manual process where the help desk adds engineers to project-specific security groups upon request
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is deploying Zero Trust and wants to ensure that only managed and compliant devices can access its SaaS applications. The identity team has integrated the identity provider with the device management system. What should they configure to enforce this requirement?

   • AA group policy that disables access to the SaaS applications from any device not joined to the domain
   • BA network segmentation rule that blocks all traffic from unmanaged devices at the firewall
   • CA policy that requires users to install a certificate on their personal devices to access the SaaS applications
   • DA conditional access policy that requires the device to be marked as compliant before granting access to the SaaS applications
   Reveal Solution Discussion Select an answer first