Design Data Centric Zero Trust ZERO-TRUST-DESIGN Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A healthcare organization is implementing Zero Trust for its electronic health records (EHR) system. The compliance team requires that only physicians directly involved in a patient's care can view the full record, while billing staff can only see the minimum data needed for claims. The organization uses Azure AD for identity and has deployed Microsoft Information Protection (MIP) labels. Which approach should the data architect take to enforce this requirement?

   • AUse attribute-based access control (ABAC) with policies that evaluate user attributes (e.g., department, role) and resource attributes (e.g., patient ID, care team membership) to grant access only when there is a documented care relationship.
   • BCreate a separate Azure AD group for each patient and add the treating physicians to that group, then use group-based access control to grant access to the patient's records.
   • CEncrypt the EHR data with customer-managed keys and provide the decryption key only to the billing department, while physicians use a separate copy of the data.
   • DApply sensitivity labels to the EHR data and configure conditional access policies that block access for users without the 'Physician' role.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the recommended approach for securely deleting data that is no longer needed in a Zero Trust environment?

   • AOverwrite the data multiple times or use cryptographic erasure
   • BEncrypt the data and store it in a different location
   • CDelete the data and empty the recycle bin
   • DMove the data to an archive folder
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A technology company has implemented a Zero Trust data access policy that grants employees access to sensitive source code only from managed devices and corporate network locations. The security team wants to detect potential exfiltration attempts. Which monitoring approach would best detect an insider who is downloading large volumes of source code to a personal USB drive?

   • AUse data loss prevention (DLP) to block all downloads from the repository to USB drives.
   • BRequire multi-factor authentication for all repository access and block access from unmanaged devices.
   • CMonitor for failed authentication attempts to the source code repository.
   • DEnable audit logging on the repository and use analytics to alert on unusual download volumes or patterns, such as a user downloading an entire repository at once.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A multinational corporation is implementing data-centric Zero Trust. They need to ensure that data classified as 'Confidential' is only accessible to employees in specific geographic regions due to data residency requirements. They also want to automatically apply stricter access controls when data is shared externally. Which combination of controls should they implement?

   • AEncrypt all 'Confidential' data with a key stored in a specific Azure region and rely on the key location to enforce residency.
   • BCreate separate SharePoint sites for each region and manually grant access to users based on their department.
   • CUse a data loss prevention (DLP) policy that blocks all external sharing of 'Confidential' data, regardless of the user's location.
   • DUse sensitivity labels to mark data as 'Confidential' and configure conditional access policies that restrict access based on the user's location and device compliance.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial services firm is moving to a Zero Trust model. They suspect that sensitive customer data may reside in unstructured file shares, email attachments, and SaaS applications, but they have no complete inventory. The security team needs to establish a baseline for protection and detect future exfiltration. What should they do first?

   • ACreate a data retention policy that automatically deletes all files older than one year to reduce the attack surface.
   • BRun a data discovery and classification scan across on-premises file shares, SharePoint, and email to identify and label sensitive data, then use that inventory to inform protection policies.
   • CDeploy a data loss prevention (DLP) policy that blocks all outbound transfers of data matching a credit card number pattern.
   • DImmediately encrypt all data at rest using a cloud access security broker (CASB) and require multi-factor authentication for all access.
   Reveal Solution Discussion Select an answer first