Edge Identity and Authentication GCSA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company has edge devices that authenticate using certificates. They want to implement zero trust, but they also need to minimize the performance impact on the devices. Which approach balances security and performance?

   • AUse a static API key for authentication and rely on network segmentation.
   • BUse short-lived certificates and perform local validation of the certificate revocation list (CRL) cached on the device.
   • CUse mutual TLS with full certificate chain validation on every request without caching.
   • DUse long-lived certificates and check revocation status online for every request.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company builds edge devices that include third-party software components. The security team wants to ensure that these components are authentic and have not been tampered with before they are integrated into the device image. Which control should they implement in their CI/CD pipeline?

   • AUse the latest version of each component without verification.
   • BDownload the components from the vendor's website over HTTPS.
   • CStore the components in a private repository and rely on access control.
   • DVerify the checksum and digital signature of each third-party component against the vendor's published values.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A retail chain deploys point-of-sale (POS) terminals at hundreds of stores. Each terminal runs a containerized payment application that must authenticate to a central cloud backend. The network team prohibits inbound connections from the internet to the stores, and the terminals have no stable public IP addresses. The security team requires that each terminal prove its identity cryptographically before any API call is accepted. Which approach should the platform team implement?

   • AStore a shared API key in each terminal's container image and have the backend validate it.
   • BUse OAuth 2.0 client credentials with a single client ID shared by all terminals.
   • CIssue each terminal a client certificate signed by an internal CA and configure the backend to require mutual TLS.
   • DAssign each terminal a static private IP and add those IPs to an allowlist in the backend's network security group.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company has edge devices that use mutual TLS to authenticate to a cloud backend. They want to implement zero trust by continuously verifying the device's identity and posture. Which additional control is most aligned?

   • AUse a longer certificate validity period to reduce the frequency of re-authentication.
   • BUse a device attestation service that provides a signed statement of the device's current software and configuration, and require it with each request.
   • CUse a shared secret for all devices to simplify authentication.
   • DUse a static IP allowlist to restrict access to the backend.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A utility company manages thousands of smart meters that communicate with a central system. Each meter has a unique identity and uses certificates for authentication. The security team wants to ensure that a compromised meter cannot be used to access other meters' data. Which principle should guide their design?

   • AAllow all meters to access all data because they are on the same network.
   • BRely on the central system to filter data after it is received.
   • CUse a single shared certificate for all meters to simplify management.
   • DImplement least privilege so each meter can only access its own data and the specific functions it needs.
   Reveal Solution Discussion Select an answer first