Explain the Significance of Zero Trust Pillars ZERO-TRUST-DESIGN Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A financial services firm is moving to a Zero Trust model. They are concerned about an attacker who compromises one application server and then tries to move laterally to other systems. Which control set best addresses this specific threat?

   • AFull-disk encryption on all servers and backups stored in an isolated vault
   • BMicro-segmentation between application tiers and least-privilege permissions on each application
   • CA next-generation firewall at the internet edge and intrusion detection on the perimeter
   • DStrong MFA for all administrators and regular password rotation for service accounts
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   How does the Devices pillar treat devices in a Zero Trust model?

   • AAs untrusted until they prove compliance
   • BAs trusted if they are managed by IT
   • CAs trusted if they are within the corporate network
   • DAs untrusted only if they are personal devices
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of the Identity pillar in a Zero Trust architecture?

   • ATo enforce encryption on data at rest
   • BTo monitor network traffic for anomalies
   • CTo ensure that only verified users and entities gain access
   • DTo check device health before granting access
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A hospital is implementing Zero Trust. A doctor needs to access patient records from a personal tablet while on call. The tablet is not enrolled in the hospital's MDM. The security team wants to allow access but with appropriate safeguards. Which approach best balances usability and security, considering the interplay of pillars?

   • AAllow access only if the doctor passes MFA, the tablet passes a browser-based compliance check, and the session is limited to view-only access
   • BProvide the doctor with a VPN connection and allow full access to patient records
   • CBlock all access from the personal tablet and require the doctor to use a hospital-issued device
   • DAllow access with just a password, since the doctor is a trusted employee
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company runs a containerized application in a Kubernetes cluster. The security team wants to protect the application from compromised containers and limit what a container can do if it is breached. Which control set aligns with the Applications & Workloads pillar?

   • AUse a container image scanner to check for vulnerabilities before deployment
   • BMonitor container logs and alert on suspicious activity
   • CRun containers with the least privileges needed, and use network policies to restrict which containers can communicate with each other
   • DEncrypt all container images and store them in a private registry
   Reveal Solution Discussion Select an answer first