A multinational company must comply with data residency regulations while implementing Zero Trust. They plan to use a cloud provider with regions in multiple countries. Which governance policy is most appropriate?

Store and process data only in regions that meet the residency requirements.

Use a single global region for all data to simplify management.

Rely on the cloud provider's compliance certifications.

Encrypt all data and allow storage in any region.

A company is adopting Zero Trust and wants to move from a traditional VPN-based remote access model to a more granular approach. They need to give remote employees access only to specific applications, not the entire network. Which implementation strategy should they use?

Keep the VPN but add multi-factor authentication for all users.

Use a remote desktop gateway that allows users to access a single jump server.

Deploy a software-defined perimeter (SDP) that creates per-application access policies based on user identity and device posture.

Implement a network access control (NAC) solution that checks device compliance before allowing network access.

A company is implementing Zero Trust and wants to ensure that every access request is verified, even if the user is already authenticated. They also want to limit access to only the resources needed for each user's role. Which principle are they applying?

Identity and access management (IAM) and single sign-on (SSO).

Defense in depth and network segmentation.

Never trust, always verify, and least privilege access.

Data encryption and data loss prevention (DLP).

Which statement best describes the core principle of 'never trust, always verify' in a Zero Trust architecture?

Every access request is treated as if it originates from an untrusted source until it is authenticated and authorized.

Access is granted once and then monitored for suspicious activity.

Access decisions are based on the user's role and group memberships.

Users are granted access based on their physical location within the corporate network.

A company wants to implement Zero Trust for remote workers accessing internal applications. They already have identity and device management. Which additional component is essential to enforce 'never trust, always verify'?

A single sign-on solution for all applications.

A next-generation firewall at the corporate data center.

A VPN that provides network-level access to the internal network.

A software-defined perimeter that grants access only to specific applications after verifying user and device context.

GIAC Cloud Security Architecture and Design

Domain 5Objective 1

Implementing Zero Trust GCAD Practice Questions (Page 7)

Part of the Zero Trust and Governance domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

5concepts

Questions 31–35

31expert · hard
A multinational company must comply with data residency regulations while implementing Zero Trust. They plan to use a cloud provider with regions in multiple countries. Which governance policy is most appropriate?
Select an answer first
32application · medium
A company is adopting Zero Trust and wants to move from a traditional VPN-based remote access model to a more granular approach. They need to give remote employees access only to specific applications, not the entire network. Which implementation strategy should they use?
Select an answer first
33application · easy
A company is implementing Zero Trust and wants to ensure that every access request is verified, even if the user is already authenticated. They also want to limit access to only the resources needed for each user's role. Which principle are they applying?
Select an answer first
34foundation · easy
Which statement best describes the core principle of 'never trust, always verify' in a Zero Trust architecture?
Select an answer first
35application · medium
A company wants to implement Zero Trust for remote workers accessing internal applications. They already have identity and device management. Which additional component is essential to enforce 'never trust, always verify'?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.