A company is implementing Zero Trust for its on-premises data center. The security team wants to limit lateral movement between the web tier and the database tier. They also need to enforce least privilege for service accounts. Which two actions should they prioritize?

Enable continuous monitoring of database access and rely on a single firewall rule that allows all internal traffic, with service accounts granted broad access.

Deploy micro-segmentation with per-tier firewall rules and use separate service accounts with minimal permissions for each tier.

Implement a software-defined perimeter that only allows database access from the web tier's IP address and use a shared service account for simplicity.

Apply a network ACL that blocks all traffic to the database tier and use the same service account for both tiers to reduce administrative overhead.

A company is implementing Zero Trust and wants to ensure that users have the minimum level of access required to perform their job functions. They also want to regularly review and adjust these permissions. Which principle and governance control should they apply?

Single sign-on and multi-factor authentication.

Defense in depth and continuous monitoring.

Network segmentation and a firewall.

Least privilege access and periodic access reviews.

A company is moving to a Zero Trust model. They want to ensure that every request to an internal application is authenticated, authorized, and encrypted, regardless of the user's location. Which component should they deploy to enforce this?

A virtual private network (VPN) concentrator that encrypts all traffic from remote users.

A reverse proxy that terminates TLS and performs authentication and authorization before forwarding the request.

A network firewall that only allows traffic from the corporate VPN IP range.

A load balancer that distributes traffic to multiple application servers.

A company is designing a Zero Trust architecture and wants to ensure that access decisions are based on the principle of 'never trust, always verify'. Which practice is essential?

Rely on the firewall to block external threats.

Verify the identity and security posture of every request, regardless of source.

Trust requests that originate from the internal network.

Verify users only when they first connect to the network.

Which implementation strategy is characterized by hiding application resources from the public internet and granting access only to verified users?

Identity and access management (IAM)

Software-defined perimeter (SDP)

GIAC Cloud Security Architecture and Design

Domain 5Objective 1

Implementing Zero Trust GCAD Practice Questions (Page 5)

Part of the Zero Trust and Governance domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

5concepts

Questions 21–25

21application · medium
A company is implementing Zero Trust for its on-premises data center. The security team wants to limit lateral movement between the web tier and the database tier. They also need to enforce least privilege for service accounts. Which two actions should they prioritize?
Select an answer first
22application · easy
A company is implementing Zero Trust and wants to ensure that users have the minimum level of access required to perform their job functions. They also want to regularly review and adjust these permissions. Which principle and governance control should they apply?
Select an answer first
23application · medium
A company is moving to a Zero Trust model. They want to ensure that every request to an internal application is authenticated, authorized, and encrypted, regardless of the user's location. Which component should they deploy to enforce this?
Select an answer first
24application · medium
A company is designing a Zero Trust architecture and wants to ensure that access decisions are based on the principle of 'never trust, always verify'. Which practice is essential?
Select an answer first
25foundation · easy
Which implementation strategy is characterized by hiding application resources from the public internet and granting access only to verified users?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.