Design Identity Based Zero Trust ZERO-TRUST-DESIGN Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is moving from a traditional perimeter-based security model to Zero Trust. They have a mix of on-premises and cloud applications. The security team wants to ensure that access decisions are based on user identity and context, not just network location. They also want to provide a seamless experience for users. Which approach best aligns with Zero Trust principles?

   • AKeep the VPN as the primary access method for all applications, and add MFA
   • BImplement a Zero Trust network access (ZTNA) solution that evaluates user identity and device posture before granting access to applications
   • CUse a firewall to segment the network and allow access only from trusted IP addresses
   • DMove all applications to the cloud and use a single sign-on solution
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A healthcare organization needs to control access to patient records. They have a mix of employees, contractors, and partners who need different levels of access based on their role, the patient's consent status, and the time of day. They also need to support emergency access where a doctor can override consent restrictions during a life-threatening situation, but the override must be logged and reviewed. Which access control approach best meets these requirements?

   • AAn attribute-based access control (ABAC) model that evaluates user role, patient consent, and time of day, with an emergency override procedure that logs and reviews the action
   • BA manual process where each access request is reviewed by a security administrator in real time
   • CA role-based access control (RBAC) model with roles for doctors, nurses, and administrators, and a break-glass procedure for emergencies
   • DA policy that grants all medical staff full access to all patient records, with a note that emergency access is always allowed
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the function of an enforcement point in a Zero Trust identity architecture?

   • ATo monitor user behavior after access is granted
   • BTo define the security policies
   • CTo enforce the access decision made by the policy engine
   • DTo store user identities and credentials
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which process is part of identity lifecycle management?

   • ADeprovisioning accounts when an employee leaves the organization
   • BDeploying endpoint detection and response agents
   • CSetting up a VPN for remote access
   • DConfiguring firewall rules for network segmentation
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary benefit of implementing single sign-on (SSO) for users?

   • AUsers can access all resources without any authentication
   • BUsers no longer need multi-factor authentication
   • CUsers can bypass conditional access policies
   • DUsers authenticate once and gain access to multiple applications without re-entering credentials
   Reveal Solution Discussion Select an answer first