Apply Zero Trust for the Cloud ZERO-TRUST-DESIGN Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company runs containerized workloads in a cloud environment. They want to protect these workloads using Zero Trust controls, including limiting communication between containers and ensuring that only authorized images are used. What should they implement?

   • AA network security group applied to the container host that allows all traffic between containers on the same host
   • BA service mesh that provides mutual TLS (mTLS) between containers and enforces fine-grained access policies, plus a container image signing and scanning solution
   • CA container registry that only allows images from a specific repository, but no additional controls on container communication
   • DA runtime security tool that monitors container activity and alerts on suspicious behavior, but does not enforce access policies
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In a cloud environment, what is the primary reason for applying Zero Trust principles to every access request, regardless of the source?

   • ATo reduce the number of user authentication prompts
   • BTo eliminate the need for encryption of data in transit
   • CBecause the cloud perimeter is shared and cannot be relied upon as a trust boundary
   • DTo ensure that all traffic is inspected by a central firewall
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security operations team wants to implement continuous monitoring for a cloud environment to detect anomalous behavior and enforce Zero Trust. They need to collect logs from various cloud services, analyze them for threats, and automatically trigger responses to suspicious activities. What should they implement?

   • AA security information and event management (SIEM) solution that aggregates logs, uses analytics to detect anomalies, and integrates with orchestration to automate responses
   • BA cloud-native monitoring tool that only tracks resource utilization and sends alerts when thresholds are exceeded
   • CA manual process where security analysts review logs on a weekly basis and manually block suspicious IP addresses
   • DA network firewall that logs all traffic and sends alerts for known malicious IP addresses
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company uses a cloud identity provider (IdP) and wants to implement least-privilege access for their cloud resources. They need to ensure that users only have the permissions necessary to perform their job functions, and that these permissions are granted dynamically based on the user's context. What should they implement?

   • AA single administrator role that has full access to all resources, and a policy that requires MFA for all users
   • BRole-based access control (RBAC) with custom roles that define the minimum permissions for each job function, and conditional access policies that grant access based on user, device, and location
   • CA policy that grants permissions based on the user's IP address, and requires users to request access through a ticketing system
   • DA policy that grants all users the same set of permissions, and relies on network segmentation to limit access
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which statement best describes how the Zero Trust principle of 'never trust, always verify' applies to cloud environments?

   • ATrust is granted based on the network location of the user or device.
   • BAccess is granted only after verifying the identity, device health, and context of each request.
   • CAccess is granted automatically to all users once they are inside the corporate network.
   • DTrust is established once and then maintained for the duration of a session.
   Reveal Solution Discussion Select an answer first