A company runs a containerized application on Azure Kubernetes Service (AKS). They want to enforce Zero Trust by ensuring that each microservice can only communicate with the services it needs, and that all traffic between services is encrypted. Which solution should they implement?

Use Kubernetes Network Policies to restrict traffic between pods, and rely on the underlying network encryption provided by the cloud provider.

Use a single network security group for the AKS cluster and allow all traffic between pods.

Implement a service mesh like Istio or Linkerd to enforce mTLS and fine-grained access policies between microservices.

Place all microservices in the same pod and use localhost communication to avoid network exposure.

What is a key Zero Trust control for a serverless function that processes sensitive data?

Using a dedicated service account with permissions scoped to the function's specific tasks

Granting the function broad permissions to all cloud resources by default

Placing the function in the same network segment as all other functions

Disabling encryption for the function's input and output data

A company operates a hybrid environment with on-premises Active Directory and workloads in both AWS and Azure. They want to implement Zero Trust by using a single identity provider for all cloud and on-premises resources. They also need to enforce conditional access policies that consider user risk and device compliance. Which approach should they take?

Extend on-premises Active Directory to Azure AD using Azure AD Connect, and use Azure AD conditional access for all cloud resources.

Use a third-party identity provider that supports federation with both AWS and Azure, and integrate it with on-premises Active Directory via federation.

Use on-premises Active Directory as the sole identity provider for all cloud resources by configuring each cloud to trust the on-premises AD directly.

Create separate identity stores in AWS and Azure, and synchronize them with on-premises Active Directory using a custom sync tool.

Which mechanism is used in cloud IAM to enforce Zero Trust by granting temporary, elevated access only when needed?

Open network access to the management plane

In a Zero Trust cloud architecture, what does 'least privilege' refer to?

Granting users the minimum permissions needed to perform their job functions

Restricting access to only external users

Providing all users with the same level of access for simplicity

Giving administrators unrestricted access to all resources

Dell Zero Trust Design

Domain 7Objective 1

Design Zero Trust for the Cloud ZERO-TRUST-DESIGN Practice Questions (Page 2)

Part of the Zero Trust for the Cloud domain, which accounts for 4% of the ZERO-TRUST-DESIGN exam.

23questions here

5free pages

7concepts

4%of the exam

Questions 6–10

6application · medium
A company runs a containerized application on Azure Kubernetes Service (AKS). They want to enforce Zero Trust by ensuring that each microservice can only communicate with the services it needs, and that all traffic between services is encrypted. Which solution should they implement?
Select an answer first
7foundation · easy
What is a key Zero Trust control for a serverless function that processes sensitive data?
Select an answer first
8expert · hard
A company operates a hybrid environment with on-premises Active Directory and workloads in both AWS and Azure. They want to implement Zero Trust by using a single identity provider for all cloud and on-premises resources. They also need to enforce conditional access policies that consider user risk and device compliance. Which approach should they take?
Select an answer first
9foundation · easy
Which mechanism is used in cloud IAM to enforce Zero Trust by granting temporary, elevated access only when needed?
Select an answer first
10foundation · easy
In a Zero Trust cloud architecture, what does 'least privilege' refer to?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ZERO-TRUST-DESIGN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Dell Technologies. “ZERO-TRUST-DESIGN” is a trademark of its owner, used for identification only.