Apply Visibility and Analytics ZERO-TRUST-DESIGN Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A Zero Trust architect is designing visibility for a hybrid environment with on-premises and cloud workloads. The team needs to monitor east-west traffic within the cloud VPC and also see on-premises traffic. Which combination of data sources provides the most comprehensive visibility?

   • AOnly cloud provider's native monitoring metrics.
   • BOn-premises SIEM logs and cloud audit logs, but no network flow data.
   • CVPC flow logs, on-premises firewall logs, and cloud workload agent telemetry.
   • DAgent-based monitoring on all workloads, but no network logs.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which data source is most appropriate for collecting visibility into user authentication attempts across a Zero Trust environment?

   • AConfiguration management database (CMDB) records
   • BNetwork packet captures (PCAP) from core switches
   • CIdentity provider (IdP) authentication logs
   • DDatabase transaction logs
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team wants to integrate their endpoint detection and response (EDR) tool with their identity provider (IdP) to automatically respond to compromised endpoints. What is a key consideration for this integration?

   • AThe integration should replace the IdP's native security features.
   • BThe integration should only send data one-way from IdP to EDR.
   • CThe integration should allow the EDR to trigger conditional access policies in the IdP.
   • DThe integration should be manual to avoid false positives.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company uses a cloud access security broker (CASB) to monitor shadow IT. They want to integrate CASB alerts with their security orchestration, automation, and response (SOAR) platform. What is the primary purpose of this integration?

   • ATo store CASB logs in the SOAR database.
   • BTo automate response actions based on CASB alerts.
   • CTo replace the CASB with the SOAR platform.
   • DTo provide a user interface for CASB administration.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Zero Trust environment uses a policy engine that makes access decisions based on risk. The risk score is calculated from multiple signals, including device compliance, user behavior, and location. What is the primary purpose of this risk-based approach?

   • ATo block all access from locations outside the corporate office.
   • BTo eliminate the need for multi-factor authentication (MFA).
   • CTo provide a static set of rules for all users.
   • DTo allow access when risk is low and require additional verification when risk is high.
   Reveal Solution Discussion Select an answer first