Design Data Centric Zero Trust ZERO-TRUST-DESIGN Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the main goal of data discovery and inventory in a Zero Trust architecture?

   • ATo classify data based on its sensitivity level
   • BTo monitor data access in real time
   • CTo automatically delete all duplicate data across the environment
   • DTo identify all data assets and their locations to establish a baseline for protection
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of an anomalous data access event that monitoring should flag?

   • AA user accessing data with a compliant device
   • BA user downloading a large volume of sensitive data at an unusual hour
   • CA user accessing the same files they access every day
   • DA user accessing data from their usual office location
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security architect is designing monitoring for a Zero Trust data environment. The organization has a mix of on-premises and cloud data stores, and they need to detect both external attackers and insider threats. They have limited budget and cannot deploy a full SIEM. Which approach provides the most effective monitoring with the least effort?

   • AHire a third-party managed security service provider (MSSP) to monitor all data access logs.
   • BUse a network intrusion detection system (NIDS) to monitor traffic to and from the data stores.
   • CEnable native audit logging on all data stores and use a cloud-native analytics service to correlate logs and alert on anomalies.
   • DDeploy a data loss prevention (DLP) solution that blocks all outbound transfers of sensitive data.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations center (SOC) is monitoring a Zero Trust environment. They notice that a user with legitimate access to a sensitive database is querying an unusually large number of records outside of normal business hours. The user's account has not been compromised. What should the SOC do first?

   • AIgnore the alert because the user has legitimate access and the behavior is not necessarily malicious.
   • BIncrease the user's access privileges to see if they are testing the system's limits.
   • CImmediately revoke the user's access to the database to prevent potential data exfiltration.
   • DInvestigate the anomaly by reviewing the user's recent activity, the specific data accessed, and any context that might explain the behavior, such as a scheduled job or a legitimate business need.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In a data-centric Zero Trust model, what does the classification level 'restricted' typically indicate?

   • AData that is publicly available and requires no protection
   • BData that can be shared freely within the organization
   • CData that requires the highest level of protection due to potential impact if compromised
   • DData that is only accessible by the data owner
   Reveal Solution Discussion Select an answer first