Design Zero Trust Networks ZERO-TRUST-DESIGN Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A retail company is implementing micro-segmentation to protect its point-of-sale (POS) systems. They want to ensure that POS systems can only communicate with the payment processing server and not with other internal systems. What is the best way to enforce this?

   • ADeploy a network monitoring tool to detect any communication from POS systems to other internal systems.
   • BUse a NAC solution to check the posture of POS devices before allowing network access.
   • CCreate a security group for POS systems and a security group for the payment server, then allow traffic only between these groups on the required ports.
   • DPlace all POS systems on the same VLAN as the payment server.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard · select all that apply

   A company is designing a Zero Trust network. They want to ensure that access decisions are based on multiple signals, including user identity, device posture, and location. Which of the following are essential components of this approach? (Select all that apply.)

   • AAn identity provider that authenticates users and devices.
   • BA traditional perimeter firewall that blocks all inbound traffic.
   • CA policy engine that evaluates all signals and makes access decisions.
   • DA continuous monitoring system that feeds real-time risk data into the policy engine.
   Check answers Discussion Select an answer first
4. 18foundation · easy

   Which statement best describes a core principle of Zero Trust networking?

   • ADevices that have passed a one-time authentication are trusted for the duration of their network session.
   • BTrust is granted based on the network location of the device, such as being inside the corporate perimeter.
   • CUsers inside the network are trusted by default, while external users must be verified.
   • DEvery access request is verified regardless of whether the user or device is inside or outside the network.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A manufacturing company has a legacy SCADA system that cannot support modern authentication protocols. They are implementing Zero Trust networking and need to integrate this legacy system securely. Which approach is most appropriate?

   • APlace the SCADA system in a dedicated network segment with strict firewall rules and require a jump host for access.
   • BEncrypt all traffic to and from the SCADA system using TLS.
   • CConnect the SCADA system directly to the corporate network without any additional controls.
   • DUpgrade the SCADA system to support modern authentication protocols.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company has implemented micro-segmentation in its data center. The security team wants to detect any unusual east-west traffic that might indicate a compromised workload. What should they deploy to gain visibility into this traffic?

   • AUse a packet capture tool on a single server to analyze its traffic.
   • BRely on the micro-segmentation policy logs alone.
   • CEnable flow logs on the virtual switches and analyze them with a SIEM.
   • DDeploy a traditional firewall at the internet edge and monitor its logs.
   Reveal Solution Discussion Select an answer first