Apply Visibility and Analytics ZERO-TRUST-DESIGN Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team wants to integrate their vulnerability scanner with their SIEM to prioritize alerts based on asset criticality. What is the primary benefit?

   • AIt allows the SIEM to correlate vulnerability data with asset value, improving prioritization.
   • BIt replaces the vulnerability scanner with the SIEM.
   • CIt eliminates the need for manual patching.
   • DIt automatically fixes vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is designing a visibility architecture for a Zero Trust model. They need to detect compromised accounts and insider threats. They have limited budget and cannot deploy agents on all endpoints. Which approach provides the most effective visibility within these constraints?

   • AUse only endpoint detection and response (EDR) on a subset of high-risk users.
   • BDeploy network taps on all critical network segments and analyze raw packets.
   • CRely on periodic manual audits of user access rights.
   • DCollect and analyze identity provider logs, VPN logs, and cloud access logs centrally.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which analytics technique is best suited for detecting previously unknown threats in a Zero Trust environment?

   • ARule-based alerting on static thresholds
   • BManual log review by security analysts
   • CSignature-based detection
   • DUser and entity behavior analytics (UEBA)
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In a Zero Trust architecture, which collection point is essential for capturing network-level visibility of east-west traffic between workloads?

   • AIdentity provider (IdP) sign-in logs
   • BNetwork flow logs from virtual switches and firewalls
   • CEndpoint detection and response (EDR) telemetry only
   • DCloud access security broker (CASB) logs
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A Zero Trust architect needs to detect when a user's device is jailbroken or rooted, which could indicate a higher risk. Which data source should be integrated into the analytics platform?

   • AMobile device management (MDM) compliance signals.
   • BCloud access security broker (CASB) logs.
   • CIdentity provider sign-in logs.
   • DNetwork flow logs.
   Reveal Solution Discussion Select an answer first