Apply Zero Trust in Networks ZERO-TRUST-DESIGN Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A hospital network has a legacy building-management system (BMS) that controls HVAC and elevators. The BMS is on the same flat VLAN as the clinical workstations. The security team wants to prevent the BMS from being used as a pivot point to reach patient records, while still allowing the BMS vendor to remotely manage the system. Which approach best aligns with Zero Trust principles?

   • APlace the BMS in a separate micro-segmented VLAN with a deny-by-default firewall policy, and allow only the vendor's management IPs over an encrypted VPN.
   • BKeep the BMS on the same VLAN but apply a host-based firewall on each clinical workstation to block traffic to the BMS.
   • CMove the BMS to a new VLAN and allow all traffic from the clinical VLAN to the BMS for monitoring purposes.
   • DImplement MAC address filtering on the BMS port to ensure only the BMS device can connect to the network.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A healthcare provider is implementing Zero Trust network access for its clinicians. The provider wants to ensure that clinicians can access patient records only from approved devices and locations. Which control is most aligned with this requirement?

   • AUse a shared workstation for all clinicians to simplify management.
   • BImplement conditional access policies that evaluate device compliance and location before granting access.
   • CProvide all clinicians with a VPN that grants access to the entire network.
   • DAllow access based on the clinician's role only, without checking device or location.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A retail company is integrating Zero Trust with its existing legacy ERP system that does not support modern authentication protocols. The security team wants to protect the ERP system without disrupting its operations. Which approach is most effective?

   • APlace the ERP system behind an application gateway that enforces modern authentication and forwards requests to the ERP.
   • BReplace the ERP system with a modern, Zero Trust-compatible system.
   • CDisable all external access to the ERP system to reduce risk.
   • DExpose the ERP system directly to the network and rely on its built-in authentication.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A logistics company is deploying a new fleet management system that uses IoT sensors to transmit location data to a central server. The security team requires that the data be encrypted in transit and that the sensors only communicate with the central server. Which solution best meets these requirements?

   • ASend the sensor data over a public network without encryption to reduce latency.
   • BUse TLS certificates on the sensors and configure the server to only accept traffic from authenticated sensors.
   • CUse a shared API key for all sensors to simplify authentication.
   • DPlace the sensors on the same network as the central server and rely on network segmentation.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A healthcare organization is implementing end-to-end encryption for data in transit between its clinics and the central data center. The organization uses a mix of MPLS and internet connections. The security team wants to ensure that all traffic is encrypted, but the operations team is concerned about the performance impact of encryption on the MPLS links. Which approach best balances security and performance?

   • AUse application-level encryption for all traffic, regardless of the underlying network.
   • BUse IPsec VPN tunnels over both MPLS and internet connections, and offload encryption to dedicated hardware.
   • CEncrypt only the traffic over the internet connections, as MPLS is considered secure.
   • DDisable encryption on MPLS links to improve performance, and rely on network segmentation.
   Reveal Solution Discussion Select an answer first