Design Identity Based Zero Trust ZERO-TRUST-DESIGN Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of identity lifecycle management in a Zero Trust architecture?

   • ATo reduce the number of passwords users need to remember
   • BTo provide a single sign-on experience across all applications
   • CTo automatically assign the highest level of access to new employees
   • DTo ensure that users have access only for the duration of their need and that access is revoked when no longer required
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is designing a Zero Trust architecture for a hybrid environment with on-premises and cloud resources. They want to use a central policy engine to make access decisions based on user, device, and location signals. They also want to enforce these decisions at multiple enforcement points, such as the network, applications, and data. Which architecture pattern should they use?

   • AA separate policy engine for each enforcement point to avoid a single point of failure
   • BA central policy engine that sends decisions to enforcement points via a standard protocol, such as RADIUS or SAML
   • CA policy engine that is integrated with each application's authentication mechanism
   • DA policy engine that is embedded in the network firewall only
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company uses an on-premises HR system as the source of truth for employee records. When an employee is terminated, the HR system updates the status. The identity team wants to ensure that all access to cloud applications is revoked automatically within minutes of termination. What should they implement?

   • AA manual process where the manager submits a ticket to IT to disable the user account
   • BA scheduled job that runs nightly to sync terminated users from HR to Azure AD and disable their accounts
   • CA conditional access policy that blocks sign-ins from users whose HR status is 'terminated'
   • DAn automated provisioning workflow that triggers on HR status change, disables the user in Azure AD, and removes group memberships
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In a Zero Trust architecture, what is the primary security boundary that determines access decisions?

   • AThe user's identity, verified through authentication and authorization
   • BThe type of device, such as managed vs. unmanaged
   • CThe network perimeter, such as the corporate firewall
   • DThe physical location of the user's device
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a common activity in identity governance and administration (IGA)?

   • ADeploying endpoint protection software
   • BConfiguring network firewalls
   • CSetting up virtual private networks
   • DCertifying that user access is appropriate on a regular basis
   Reveal Solution Discussion Select an answer first