Apply Identity Based Zero Trust ZERO-TRUST-DESIGN Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which process is part of the identity lifecycle management?

   • ADesigning the physical data center layout
   • BProvisioning user accounts when employees join
   • CInstalling operating system updates
   • DConfiguring network firewalls
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which principle is central to the identity-based Zero Trust model?

   • ATrust is established once at login and then maintained for the session
   • BEvery access request is verified continuously, regardless of the user's location or device
   • CUsers are granted the maximum access they might need to avoid interruptions
   • DAccess is granted based on the user's role alone, without additional checks
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a policy enforcement point (PEP) in a Zero Trust architecture?

   • AA component that stores user passwords
   • BA component that generates risk scores
   • CA component that manages user roles
   • DA component that enforces access decisions made by the policy engine
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A contractor's employment ends today. The identity team needs to ensure the contractor's access is removed promptly to prevent unauthorized access. The contractor has accounts in the HR system, the VPN, and several SaaS applications. What is the most effective way to deprovision the contractor's access?

   • AWait for the contractor's accounts to expire automatically based on the contract end date
   • BDisable the contractor's account in the identity provider, which propagates the block to all connected applications
   • CChange the contractor's password and do not inform them, hoping they do not notice
   • DManually remove the contractor from each application's user list and the VPN
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is moving from a traditional perimeter-based security model to Zero Trust. The network team plans to keep the existing VPN and firewall for remote access. The identity team wants to ensure that access decisions are based on the user's identity and context rather than just the network location. Which approach best aligns with the 'identity as the new perimeter' principle?

   • ACreate separate network segments for each department and require a jump server for cross-segment access
   • BDeploy a cloud identity provider and enforce conditional access policies that evaluate user, device, and risk before granting access to applications
   • CKeep the VPN as the primary access control and add MFA only for users connecting from untrusted networks
   • DReplace the VPN with a direct internet connection for all users and rely on the firewall to filter traffic
   Reveal Solution Discussion Select an answer first