Apply Visibility and Analytics ZERO-TRUST-DESIGN Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization uses a Zero Trust network access (ZTNA) solution. They want to integrate its access logs with their existing SIEM to gain insights into user behavior. What is the primary benefit of this integration?

   • AIt reduces the volume of logs stored in the SIEM.
   • BIt replaces the need for endpoint detection and response (EDR) tools.
   • CIt automatically blocks malicious users without analyst intervention.
   • DIt enables the SIEM to correlate access patterns with other security events.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A Zero Trust architect is planning visibility for a remote workforce that uses VPN and cloud applications. They need to detect compromised credentials and unusual access patterns. Which data sources are essential?

   • AOnly cloud application logs.
   • BVPN logs, identity provider logs, and cloud application logs.
   • COnly VPN logs.
   • DNetwork flow logs from the corporate data center.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A Zero Trust environment has implemented a micro-segmentation strategy. The security team wants to verify that segmentation policies are effective and detect any policy violations. Which visibility approach is most appropriate?

   • AUse only endpoint logs to infer traffic patterns.
   • BCollect and analyze flow logs between segments and compare against expected traffic patterns.
   • CMonitor only north-south traffic at the perimeter.
   • DPerform periodic manual reviews of firewall rules.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A multinational company must comply with data residency laws that require certain telemetry to remain within the country of origin. They are designing a visibility architecture that aggregates logs from multiple regions. What is the best way to handle this requirement?

   • AEncrypt logs before sending to a central SIEM.
   • BDeploy regional SIEM instances and aggregate only metadata to a central SIEM.
   • CSend all logs to a central SIEM located in a single region.
   • DStore logs locally on each device and never centralize them.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A Zero Trust environment has implemented user and entity behavior analytics (UEBA). The analytics platform flags a user who normally accesses files from 9 AM to 5 PM, but now downloads a large volume of data at 2 AM. The user's credentials are valid and the device is compliant. What should the security team do first?

   • ABlock the user's access immediately and force a password reset.
   • BTreat the anomaly as a potential compromise and initiate an automated investigation workflow.
   • CIgnore the alert because the user's credentials are valid and the device is compliant.
   • DIncrease the user's permissions to allow the activity, assuming it is legitimate.
   Reveal Solution Discussion Select an answer first