Design Zero Trust for the Cloud ZERO-TRUST-DESIGN Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company runs serverless functions on AWS Lambda. They want to enforce Zero Trust by ensuring that each function can only access the specific resources it needs, and that the function's code is scanned for vulnerabilities before deployment. Which combination of controls should they implement?

   • AUse environment variables to store credentials and rely on the Lambda service to protect them.
   • BPlace all Lambda functions in a VPC and use security groups to restrict network access.
   • CUse IAM roles with least-privilege policies for each Lambda function, and integrate a code scanning tool into the CI/CD pipeline.
   • DUse a single IAM role for all Lambda functions, and enable AWS Config to monitor for misconfigurations.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company uses a multi-cloud environment with workloads in AWS and Azure. The security team wants to continuously monitor for misconfigurations, such as publicly accessible storage buckets and overly permissive security groups. They also want to receive alerts when a workload deviates from the company's security baseline. Which solution should they implement?

   • AUse AWS Config and Azure Policy separately, and manually review the compliance reports on a weekly basis.
   • BEnable CloudTrail and Azure Activity Log, and use a log analytics tool to search for misconfigurations after they occur.
   • CDeploy a cloud security posture management (CSPM) tool that supports both AWS and Azure, and configure it to assess resources against the company's security baseline and send alerts on violations.
   • DImplement a vulnerability scanner that scans the workloads for known CVEs and patches them automatically.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary goal of Cloud Security Posture Management (CSPM) in a Zero Trust environment?

   • ATo provide a one-time security assessment
   • BTo manage user passwords
   • CTo replace the need for identity and access management
   • DTo continuously monitor cloud configurations and compliance against security policies
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company uses a multi-tier application in a cloud environment. They want to implement micro-segmentation to limit lateral movement in case of a breach. They have identified that the web tier needs to communicate with the application tier on port 8080, and the application tier needs to communicate with the database tier on port 3306. Which configuration should they implement?

   • AUse a single firewall appliance to inspect all traffic between tiers and allow only the required ports.
   • BPlace all tiers in the same security group and rely on the operating system firewall to restrict traffic.
   • CUse a network ACL that allows all traffic between the subnets where the tiers are located.
   • DCreate security groups that allow only the specific traffic between tiers, and apply them to the respective instances.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which technology is commonly used to enforce micro-segmentation in a cloud environment?

   • AA single firewall at the network perimeter
   • BPhysical network cables
   • CA shared VLAN for all workloads
   • DSoftware-defined networking (SDN)
   Reveal Solution Discussion Select an answer first