Apply Zero Trust for the Cloud ZERO-TRUST-DESIGN Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   A company is migrating a three-tier application (web, app, database) to a cloud environment. The security team wants to apply Zero Trust principles to protect the workloads. They need to ensure that the web tier can only communicate with the app tier on a specific port, and the app tier can only communicate with the database tier on another specific port. Lateral movement between tiers must be blocked. What should they implement?

   • AA single network security group applied to all subnets with a broad allow rule for all internal traffic
   • BNetwork security groups (NSGs) applied to each subnet with allow rules for the required ports and deny rules for all other traffic
   • CAzure Firewall deployed in front of the web tier only, with rules to filter traffic to the app and database tiers
   • DA virtual network (VNet) with a single subnet for all tiers, relying on application-level authentication for access control
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In a Zero Trust cloud identity model, what does 'least privilege' mean for a user's permissions?

   • AUsers have no permissions until they request them each time
   • BUsers receive the same permissions as their manager for consistency
   • CUsers are granted only the permissions required to perform their job functions
   • DUsers are granted all permissions by default and then removed if they misbehave
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company runs virtual machines (VMs) in a cloud environment. They want to protect these workloads using Zero Trust controls, including limiting communication between VMs and ensuring that only authorized software is installed. What should they implement?

   • AA single NSG that allows all traffic between VMs, and a host-based intrusion detection system (HIDS) that alerts on suspicious activity
   • BNetwork security groups (NSGs) that restrict traffic between VMs, and a vulnerability management solution that scans for unauthorized software and patches
   • CA firewall that allows all traffic between VMs on the same subnet, and a policy that requires administrators to manually review installed software
   • DA VPN that connects all VMs to a single network, and a policy that requires all software to be approved by the security team
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which control is specifically designed to protect a cloud workload by allowing only verified and authorized connections to its application ports?

   • AA Network Security Group (NSG) rule that restricts inbound traffic to specific source IPs and ports
   • BA resource tag applied to the virtual machine
   • CA storage account access key
   • DA virtual machine's boot diagnostics setting
   Reveal Solution Discussion Select an answer first