An organization is at the 'Initial' stage of Zero Trust maturity. They have no centralized identity management and rely on perimeter firewalls. The leadership wants a quick win to demonstrate progress without a large budget. Which step is most appropriate?

Purchase a next-generation firewall and call it Zero Trust.

Implement a centralized identity provider and enable MFA for all users.

Begin micro-segmentation of all data center networks.

Deploy a full software-defined perimeter across all applications.

A large enterprise is implementing Zero Trust and must balance the need for strict access control with user productivity. They have a mature identity platform but lack device management for many employee-owned devices. Which governance approach best addresses this trade-off?

Deploy a software-defined perimeter but only for managed devices.

Require all devices to be enrolled in MDM before accessing any corporate resource.

Provide VPN access to all users regardless of device posture.

Allow access to low-risk applications from unmanaged devices but require MFA and session monitoring.

A company is implementing Zero Trust and wants to enforce least privilege for a web application that must access a database. The security team has decided to use micro-segmentation. Which configuration best aligns with Zero Trust principles?

Use a single subnet for all application tiers and rely on host-based firewalls on each VM.

Place the web application and database in the same subnet and rely on network ACLs to restrict traffic.

Create separate subnets for the web application and database, and allow only the web application's service account to connect to the database on the required port.

Allow all traffic within the VNet and use encryption to protect data in transit.

A government agency is implementing Zero Trust. They have a requirement to log all access to classified data and retain logs for at least seven years. They also need to ensure that only authorized personnel can access the logs. Which governance control should they implement?

Store logs locally on each server and allow administrators to access them as needed.

Use a SIEM that only keeps logs for 30 days to reduce storage costs.

Encrypt logs and store them in a public cloud bucket with public read access.

Implement a centralized logging solution with role-based access control (RBAC) and immutable log storage.

GIAC Cloud Security Architecture and Design

Domain 5Objective 1

Implementing Zero Trust GCAD Practice Questions (Page 4)

Part of the Zero Trust and Governance domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

5concepts

Questions 16–20

16expert · hard
An organization is at the 'Initial' stage of Zero Trust maturity. They have no centralized identity management and rely on perimeter firewalls. The leadership wants a quick win to demonstrate progress without a large budget. Which step is most appropriate?
Select an answer first
17expert · hard
A large enterprise is implementing Zero Trust and must balance the need for strict access control with user productivity. They have a mature identity platform but lack device management for many employee-owned devices. Which governance approach best addresses this trade-off?
Select an answer first
18application · medium
A company is implementing Zero Trust and wants to enforce least privilege for a web application that must access a database. The security team has decided to use micro-segmentation. Which configuration best aligns with Zero Trust principles?
Select an answer first
19expert · hard
A government agency is implementing Zero Trust. They have a requirement to log all access to classified data and retain logs for at least seven years. They also need to ensure that only authorized personnel can access the logs. Which governance control should they implement?
Select an answer first
20foundation · easy
In the context of Zero Trust, which component focuses on ensuring that only authorized and healthy devices can access resources?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.