Describe Microsegementation, SDP, and Enhanced Identity Governance Approaches ZERO-TRUST-DESIGN Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large enterprise is implementing microsegmentation across its data center. The security team has created a set of policies that allow traffic between specific application tiers. However, during testing, they discover that some legitimate traffic is being blocked because the workloads are dynamically scaled and their IP addresses change frequently. Which approach should the team take to maintain security while avoiding disruption?

   • AUse workload tags or labels in the microsegmentation policies instead of IP addresses.
   • BDisable microsegmentation for the affected workloads until the IP addresses stabilize.
   • CCreate a broad allow rule for all traffic between the affected subnets.
   • DManually update the policies each time an IP address changes.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A financial institution is implementing enhanced identity governance. The security team wants to reduce the risk of privilege creep by automatically identifying users who have accumulated excessive permissions over time. However, the team also wants to avoid overwhelming administrators with alerts. Which approach best balances these concerns?

   • AUse identity analytics to continuously monitor user access and flag only users whose permissions deviate significantly from their peer group.
   • BImplement a policy that automatically revokes any permission that has not been used in the last 90 days.
   • CUse role mining to create a new role for every possible combination of permissions.
   • DConduct manual access reviews for all users on a quarterly basis.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A healthcare organization is integrating enhanced identity governance with its Zero Trust architecture. The organization must comply with regulations that require access to patient records to be granted only to authorized personnel and that all access be reviewed periodically. The security architect is designing the integration between the identity governance system and the SDP. Which approach best ensures that access decisions are based on the most current identity data?

   • AThe identity governance system periodically exports a list of authorized users to the SDP controller.
   • BThe SDP controller queries the identity governance system in real time for each access request.
   • CThe SDP gateway stores a local copy of all user roles and permissions.
   • DThe identity governance system sends a daily report of access changes to the security team for manual review.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which Zero Trust component would most directly use the output of identity governance to make an access decision?

   • AThe DNS server
   • BThe policy enforcement point (PEP)
   • CThe network firewall
   • DThe certificate authority
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is implementing enhanced identity governance and wants to automatically identify users who have excessive permissions compared to their peers in the same role. Which technology should the company use?

   • APolicy-based access control
   • BRole mining
   • CIdentity analytics
   • DAccess certifications
   Reveal Solution Discussion Select an answer first