Design Zero Trust for the Cloud ZERO-TRUST-DESIGN Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which activity is a key function of Cloud Security Posture Management (CSPM)?

   • AManaging on-premises hardware inventory
   • BPerforming a single annual security audit
   • CProviding a virtual private network (VPN) for remote users
   • DContinuously scanning for misconfigurations and compliance drift
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of micro-segmentation in a Zero Trust cloud network?

   • ATo replace the need for identity-based access controls
   • BTo allow all traffic between workloads without inspection
   • CTo isolate workloads and limit lateral movement
   • DTo combine all workloads into a single flat network for simplicity
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which control is a core element of Zero Trust data protection for cloud-stored data?

   • AGranting all users full access to data
   • BEncrypting data at rest and in transit
   • CDisabling access logs for data stores
   • DStoring data in plaintext for easy access
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company uses Azure AD as its identity provider for a multi-cloud environment that includes AWS and Google Cloud. The security team wants to enforce Zero Trust by requiring multi-factor authentication (MFA) for all cloud console access, but only when the user's risk level is medium or higher. They also need to block access from untrusted locations. Which configuration should they implement?

   • AConfigure a VPN requirement for all cloud console access and enforce MFA at the VPN gateway only.
   • BUse Azure AD Privileged Identity Management to require MFA only for users with administrative roles and rely on each cloud's native location controls.
   • CEnable MFA for every user in Azure AD and configure a separate policy in each cloud provider to block untrusted locations.
   • DCreate a conditional access policy in Azure AD that targets all cloud apps, requires MFA when sign-in risk is medium or higher, and blocks access from untrusted locations.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company runs a containerized application on a cloud platform. They want to enforce Zero Trust by ensuring that containers run with the least privilege possible, and that the container images are scanned for vulnerabilities before deployment. Which combination of controls should they implement?

   • AUse a service mesh to encrypt traffic between containers, and rely on the cloud provider's image registry to scan images.
   • BRun all containers as root and rely on the container runtime's security features.
   • CUse a pod security policy that restricts the capabilities of containers, and manually review images before deployment.
   • DUse a container runtime that supports user namespace remapping, and integrate image scanning into the CI/CD pipeline.
   Reveal Solution Discussion Select an answer first