Apply Zero Trust for the Cloud ZERO-TRUST-DESIGN Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company wants to automate the enforcement of Zero Trust policies for their cloud workloads. They need to ensure that any new virtual machine (VM) deployed is automatically placed in the correct network segment and has the appropriate security group applied. What should they implement?

   • AInfrastructure as code (IaC) templates that define the network segmentation and security group assignments, and a CI/CD pipeline that deploys new VMs using these templates
   • BA cloud security posture management (CSPM) tool that detects VMs not in the correct segment and alerts administrators
   • CA manual process where administrators create VMs and then manually assign them to the correct network segment and security group
   • DA script that runs after VM deployment to apply security groups, but the network segment is chosen by the administrator at deployment time
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which cloud security analytics capability is used to detect patterns that indicate a potential attack?

   • AResource tagging
   • BUser and entity behavior analytics (UEBA)
   • CDisk snapshotting
   • DVirtual network peering
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team wants to implement continuous monitoring for a cloud environment to detect and respond to threats in real time. They need to collect logs from multiple sources, correlate them to identify suspicious activity, and automatically trigger responses. They also need to ensure that the monitoring system itself is protected from compromise. What should they implement?

   • AA cloud-native monitoring tool that only tracks resource utilization and sends alerts when thresholds are exceeded
   • BA log aggregation tool that stores logs in a central repository, but relies on manual analysis to detect threats
   • CA network intrusion detection system (IDS) that monitors network traffic and alerts on known signatures
   • DA SIEM solution that aggregates logs, uses machine learning to detect anomalies, and integrates with SOAR to automate responses, with the SIEM hosted in a separate, isolated network segment
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a software-defined perimeter (SDP) in a cloud environment?

   • AA VPN that encrypts all traffic between a user and the cloud
   • BA physical firewall appliance placed at the cloud provider's edge
   • CA DNS service that resolves internal hostnames
   • DA network security approach that hides application infrastructure and only allows access after device and user verification
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company stores sensitive data in a cloud database. They want to implement Zero Trust data controls, including encryption at rest and in transit, and they need to ensure that only authorized applications can access the data. They also need to monitor for unauthorized access attempts. What should they implement?

   • AUse client-side encryption for all data and require users to authenticate with username and password
   • BEnable TDE for the database and rely on the cloud provider's network security to protect data in transit
   • CEnable database auditing and use a VPN for all access to the database
   • DEnable transparent data encryption (TDE) for the database, enforce TLS for all connections, use managed identities for application authentication, and enable database auditing
   Reveal Solution Discussion Select an answer first