A company is implementing Zero Trust and wants to ensure that access decisions are based on multiple signals, such as user identity, device health, and location. They also want to enforce policies dynamically. Which approach should they take?

Use a single sign-on (SSO) solution without additional policies.

Implement a VPN that grants access to the entire network.

Use static firewall rules based on IP addresses.

Use conditional access policies that evaluate multiple signals in real time.

A company is implementing Zero Trust and needs to ensure that third-party vendors can access only specific applications, not the entire network. They also need to enforce time-based access (e.g., only during business hours) and revoke access immediately when a contract ends. Which governance control should they implement?

Create a separate VLAN for vendors and grant them access to the entire VLAN.

Implement an identity governance and administration (IGA) solution with automated access reviews and time-based policies.

Rely on the vendor's own security controls to ensure they only access what they need.

Use a shared service account for all vendors to simplify management.

A security architect is designing a Zero Trust network for a multi-tier application. The goal is to minimize lateral movement if one tier is compromised. Which strategy is most effective?

Deploy a strong encryption solution for all inter-tier traffic.

Implement a centralized logging and monitoring solution.

Place all tiers in the same subnet and rely on host-based intrusion detection.

Use micro-segmentation to isolate each tier and enforce allow-list rules for inter-tier communication.

A company is at the early stages of Zero Trust adoption. They have implemented multi-factor authentication for all users but still rely on a traditional perimeter firewall and have no micro-segmentation. According to the Zero Trust maturity model, what should be their next incremental step?

Replace the perimeter firewall with a software-defined perimeter immediately.

Focus on continuous monitoring of all network traffic before making any other changes.

Implement device compliance checks before granting access to sensitive applications.

Deploy micro-segmentation across all data center and cloud networks.

GIAC Cloud Security Architecture and Design

Domain 5Objective 1

Implementing Zero Trust GCAD Practice Questions (Page 3)

Part of the Zero Trust and Governance domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

5concepts

Questions 11–15

11foundation · easy
Which of the following is a key component of a Zero Trust architecture?
Select an answer first
12application · medium
A company is implementing Zero Trust and wants to ensure that access decisions are based on multiple signals, such as user identity, device health, and location. They also want to enforce policies dynamically. Which approach should they take?
Select an answer first
13expert · hard
A company is implementing Zero Trust and needs to ensure that third-party vendors can access only specific applications, not the entire network. They also need to enforce time-based access (e.g., only during business hours) and revoke access immediately when a contract ends. Which governance control should they implement?
Select an answer first
14application · medium
A security architect is designing a Zero Trust network for a multi-tier application. The goal is to minimize lateral movement if one tier is compromised. Which strategy is most effective?
Select an answer first
15application · medium
A company is at the early stages of Zero Trust adoption. They have implemented multi-factor authentication for all users but still rely on a traditional perimeter firewall and have no micro-segmentation. According to the Zero Trust maturity model, what should be their next incremental step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Implementing Zero Trust GCAD Practice Questions (Page 3)

Questions 11–15

Which of the following is a key component of a Zero Trust architecture?

A company is implementing Zero Trust and wants to ensure that access decisions are based on multiple signals, such as user identity, device health, and location. They also want to enforce policies dynamically. Which approach should they take?

A security architect is designing a Zero Trust network for a multi-tier application. The goal is to minimize lateral movement if one tier is compromised. Which strategy is most effective?

A company is at the early stages of Zero Trust adoption. They have implemented multi-factor authentication for all users but still rely on a traditional perimeter firewall and have no micro-segmentation. According to the Zero Trust maturity model, what should be their next incremental step?

Keep studying — Zero Trust and Governance