Design Identity Based Zero Trust ZERO-TRUST-DESIGN Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A financial services firm has a team of database administrators (DBAs) who need full access to production databases. The security team wants to enforce least privilege, reduce the risk of credential theft, and ensure that any use of elevated privileges is monitored and approved. They also want to avoid disrupting the DBAs' workflow. Which approach best meets these requirements?

   • AUse a privileged access management (PAM) solution that provides just-in-time access, requires approval for elevation, and records sessions
   • BImplement a conditional access policy that blocks access to the database from non-compliant devices
   • CCreate a separate admin account for each DBA and require them to use it only when needed, with no additional controls
   • DAssign the DBAs a permanent role with full database permissions and require MFA for all sign-ins
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company uses multiple SaaS applications, each with its own username and password. Users are frustrated with having to remember multiple credentials, and the IT team wants to reduce the risk of password reuse. They also want to enforce conditional access policies consistently across all applications. What should they implement?

   • AA single sign-on (SSO) solution that federates with each SaaS application
   • BA password manager that stores all credentials and autofills them
   • CA policy that requires users to change their passwords every 30 days
   • DA VPN that provides access to all SaaS applications
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is implementing a new HR system. The HR team needs to view employee records, but only for employees in their own department. The IT team needs to manage user accounts but should not have access to salary information. What is the best way to enforce these requirements?

   • AUse a single admin account for all HR and IT tasks
   • BUse RBAC to create roles like 'HR Manager' and 'IT Admin', and assign permissions based on job function
   • CGrant all users the same level of access and rely on the HR system's audit logs to detect misuse
   • DCreate a single role for all employees that grants access to all HR data
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of privileged access management (PAM)?

   • ATo provide all users with administrative access
   • BTo eliminate the need for passwords
   • CTo provide a single sign-on experience for all users
   • DTo control and monitor the use of privileged accounts to prevent misuse
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is least privilege important in a Zero Trust identity design?

   • AIt eliminates the need for multi-factor authentication
   • BIt ensures users can access all resources without interruption
   • CIt reduces the blast radius if a user's credentials are compromised
   • DIt simplifies the user experience by granting broad access
   Reveal Solution Discussion Select an answer first