Describe and Evaluate the Zero Trust Capabilities ZERO-TRUST-DESIGN Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A large enterprise is choosing between two Zero Trust capabilities for securing remote access: a cloud-based Zero Trust Network Access (ZTNA) solution that provides per-application access and a traditional VPN with network-level access. The ZTNA solution is more expensive per user but reduces the attack surface by limiting lateral movement. The VPN is cheaper but provides broad network access. The company has a strict budget and a high-security requirement. Which approach should they choose?

   • AZTNA, because it aligns better with Zero Trust principles despite higher cost
   • BZTNA, because it is always the cheapest option for remote access
   • CVPN, because it is more cost-effective and provides the same level of security
   • DVPN, because it is easier to integrate with existing infrastructure
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has implemented Zero Trust capabilities for Identity, Devices, and Network. However, they have not yet implemented data classification or encryption for sensitive data. They have a limited budget and must choose between implementing data classification and encryption. Which gap should be prioritized?

   • AEncryption, because it protects data at rest and in transit
   • BBoth, because they are equally important and should be implemented together
   • CData classification, because it enables targeted protection policies
   • DNeither, because the existing capabilities are sufficient
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which trade-off is most commonly associated with implementing a more comprehensive Zero Trust capability?

   • AReduced security posture
   • BIncreased complexity and operational overhead
   • CSimplified user access
   • DLower cost of implementation
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is choosing between two Zero Trust capabilities for securing access to a legacy application: one that requires users to install a software-defined perimeter (SDP) client and one that provides a web-based portal with single sign-on (SSO). The SDP client provides stronger security but requires IT support for installation. The web portal is easier for users but provides less granular control. The company has a limited IT support staff and a high-security requirement. Which capability should they choose?

   • ANeither, because the legacy application cannot be secured
   • BWeb portal, because it is easier for users and reduces IT support
   • CSDP client, because it provides stronger security despite the support burden
   • DBoth, because they can be used for different user groups
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When assessing trade-offs between Zero Trust capabilities, which factor is most likely to impact user experience?

   • AThe number of authentication steps
   • BThe operational impact on IT staff
   • CThe complexity of the architecture
   • DThe cost of the solution
   Reveal Solution Discussion Select an answer first