An organization has implemented Zero Trust for its cloud workloads but not for its on-premises environment. According to the Zero Trust maturity model, what is the best way to proceed?

Treat the on-premises environment as a separate initiative and plan a phased rollout.

Immediately migrate all on-premises workloads to the cloud.

Apply the same cloud policies to on-premises without adaptation.

Focus only on cloud workloads and ignore on-premises.

A company is moving to Zero Trust and wants to implement continuous monitoring of user and entity behavior. They need to detect anomalies that may indicate a compromised account. Which strategy should they adopt?

Deploy user and entity behavior analytics (UEBA) that baselines normal behavior and alerts on deviations.

Set up a honeypot to attract attackers.

Implement a firewall that logs all inbound and outbound traffic.

Use a vulnerability scanner to identify missing patches on servers.

An organization is adopting Zero Trust and needs to enforce policy consistently across on-premises and cloud environments. Which approach best supports this goal?

Implement a centralized policy engine that evaluates access requests based on identity, device health, and context, and enforces decisions at every access point.

Create separate policies for each environment and manually synchronize them quarterly.

Use the cloud provider's native IAM policies for all environments, including on-premises.

Rely on network firewalls to enforce access policies at the perimeter.

A company is implementing Zero Trust and needs to protect its applications from unauthorized access. They have a mix of SaaS and custom applications. Which approach provides consistent protection across both?

Rely on each SaaS provider's native security controls.

Apply network firewalls to protect custom applications only.

Develop custom security code for each application.

Use a cloud access security broker (CASB) to enforce policies across SaaS and custom apps.

GIAC Cloud Security Architecture and Design

Domain 5Objective 1

Implementing Zero Trust GCAD Practice Questions (Page 6)

Part of the Zero Trust and Governance domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

5concepts

Questions 26–30

26application · medium
An organization has implemented Zero Trust for its cloud workloads but not for its on-premises environment. According to the Zero Trust maturity model, what is the best way to proceed?
Select an answer first
27application · medium
A company is moving to Zero Trust and wants to implement continuous monitoring of user and entity behavior. They need to detect anomalies that may indicate a compromised account. Which strategy should they adopt?
Select an answer first
28application · medium
An organization is adopting Zero Trust and needs to enforce policy consistently across on-premises and cloud environments. Which approach best supports this goal?
Select an answer first
29expert · hard
A security leader wants to assess the organization's Zero Trust maturity. They have implemented micro-segmentation for critical workloads but have not extended it to all environments. They also lack a centralized policy engine. Which maturity stage is most accurate?
Select an answer first
30expert · hard
A company is implementing Zero Trust and needs to protect its applications from unauthorized access. They have a mix of SaaS and custom applications. Which approach provides consistent protection across both?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.