Design Zero Trust Networks ZERO-TRUST-DESIGN Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of encryption in a Zero Trust network?

   • ATo monitor network traffic for anomalies.
   • BTo authenticate users before they access the network.
   • CTo protect data in transit from unauthorized access and tampering.
   • DTo segment the network into isolated zones.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is implementing Zero Trust networking and needs to secure communication between microservices in a Kubernetes cluster. They want to ensure that only authorized services can communicate with each other, and that all traffic is encrypted. Which solution is most appropriate?

   • AEncrypt all traffic with IPsec between the Kubernetes nodes.
   • BUse a traditional firewall to control traffic between microservices.
   • CImplement a service mesh with mutual TLS (mTLS) and authorization policies.
   • DRely on Kubernetes Network Policies alone.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is migrating some applications to the cloud while keeping others on-premises. They want to apply Zero Trust principles consistently across both environments. Which approach is most effective?

   • AImplement a cloud-based identity provider and enforce access policies for both cloud and on-premises applications.
   • BEncrypt all traffic between the cloud and on-premises environments.
   • CUse separate security policies for cloud and on-premises environments.
   • DRely on the cloud provider's security features and ignore on-premises security.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A university wants to allow students, faculty, and guests to access the Wi-Fi network, but with different levels of access. Students and faculty should have access to internal resources, while guests should only have internet access. Which solution should they implement?

   • ADeploy a NAC solution that authenticates users and assigns them to different network segments based on their role.
   • BImplement a VPN for all users and require them to connect before accessing any network resources.
   • CUse a single open Wi-Fi network and rely on a firewall to block guest access to internal resources.
   • DCreate separate SSIDs for guests and internal users, but do not require authentication.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization is moving to a Zero Trust model. They want to ensure that a user's network access is determined by their role and the security posture of their device, rather than just their IP address. Which approach should they adopt?

   • AImplement identity-aware networking that integrates with the identity provider and device compliance checks.
   • BDeploy a SIEM to monitor logs and detect unauthorized access after the fact.
   • CUse a VLAN per department and allow all traffic within the VLAN.
   • DAssign static IP addresses to all users and create firewall rules based on those IPs.
   Reveal Solution Discussion Select an answer first