Design Data Centric Zero Trust ZERO-TRUST-DESIGN Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a typical output of a data discovery process?

   • AA map of data repositories and the types of data they contain
   • BA list of all user accounts and their permissions
   • CA list of all network devices and their IP addresses
   • DA report of all network traffic patterns
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A government agency is designing a Zero Trust data access policy for a document management system. They need to ensure that only users with a 'Top Secret' clearance can access documents labeled 'Top Secret', and that access is only granted from approved workstations. They also want to monitor for any unauthorized attempts to access these documents. Which policy design best meets these requirements?

   • AImplement attribute-based access control (ABAC) that evaluates the user's clearance level, the document's sensitivity label, and the device's compliance status, and enable audit logging on all access attempts.
   • BEncrypt the documents with a key that is only available to users with 'Top Secret' clearance, and rely on the encryption to prevent unauthorized access.
   • CUse role-based access control (RBAC) with a 'Top Secret' role and require multi-factor authentication for all access.
   • DCreate a separate document library for 'Top Secret' documents and grant access only to users in a 'Top Secret' security group.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of assigning sensitivity labels to data in a Zero Trust design?

   • ATo track the physical location of data storage devices
   • BTo replace the need for data access policies
   • CTo automatically encrypt all data regardless of its content
   • DTo identify the level of protection required for the data based on its sensitivity
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is implementing Zero Trust for data protection. They have a requirement to protect sensitive data in use, specifically to prevent screen capture and unauthorized copying of data displayed in a web application. They also need to allow users to copy small amounts of data for legitimate business purposes. Which control should they implement?

   • AUse a digital rights management (DRM) solution that restricts the ability to copy, print, or screen-capture the data, but allows copying of small amounts based on policy.
   • BRequire users to use a virtual desktop infrastructure (VDI) environment and disable clipboard redirection.
   • CEncrypt the data in transit using TLS and rely on the encryption to prevent screen capture.
   • DUse a data loss prevention (DLP) solution that blocks all copy/paste operations in the web application.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of data loss prevention (DLP) controls in a Zero Trust design?

   • ATo detect and prevent unauthorized transfer of sensitive data
   • BTo encrypt all data stored in the cloud
   • CTo manage user access permissions to data
   • DTo classify data automatically based on its content
   Reveal Solution Discussion Select an answer first