Zero Trust Endpoints GDSA Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company's security team wants to detect endpoints that are running unauthorized software, such as peer-to-peer file-sharing applications. The team has an endpoint detection and response (EDR) tool that collects process and file information. Which detection method is most effective?

   • AReview firewall logs for connections to known file-sharing peer-to-peer networks.
   • BCreate a rule in the EDR that alerts when the hash of a known unauthorized application's executable is observed running on any endpoint.
   • CUse a vulnerability scanner to check for missing patches on endpoints.
   • DMonitor network traffic for high bandwidth usage from endpoints and investigate any that exceed a threshold.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Why is it important to evaluate endpoint trust level before granting access in a zero trust model?

   • ATo ensure the endpoint has the latest operating system updates
   • BTo reduce network traffic by limiting the number of connected devices
   • CTo prevent compromised or non-compliant devices from accessing sensitive resources
   • DTo ensure that all endpoints use the same operating system
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A large enterprise is implementing micro-segmentation for its data center. The security team has identified that the legacy 'finance' application tier can only be segmented using IP addresses and ports, as it does not support modern identity-aware tags. The team is concerned about the operational overhead of managing these rules. Which approach best balances security and operational efficiency?

   • APlace the legacy application in a separate VLAN and rely on the perimeter firewall for all inter-VLAN traffic.
   • BImplement a distributed firewall policy that uses IP sets and port rules, and automate the updates to these IP sets using a CMDB as the source of truth.
   • CDeploy a network tap on the application tier's traffic and use an IPS to block malicious traffic.
   • DForce the application team to refactor the application to support identity-aware segmentation before implementing any micro-segmentation.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A law firm's remote-access policy allows partners to access case-management files from any device, but associates can only access them from firm-managed laptops. The identity provider (IdP) already knows the user's role and the device's compliance status. Which access-control model should the firm implement?

   • AA dynamic policy that evaluates both the user's role and the device's compliance status at each access request, granting access only when both conditions are met.
   • BA policy that grants access based on the user's role only, and relies on the VPN to ensure all connections come from firm-managed devices.
   • CA static rule that grants all partners full access and all associates read-only access, regardless of device.
   • DA policy that grants access to anyone who presents a valid certificate from the firm's internal certificate authority (CA).
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A global engineering firm has a zero trust architecture that uses a posture-check agent on all managed Windows laptops. The agent reports OS patch level, antivirus status, and disk encryption status to the access gateway. Recently, the firm acquired a small subsidiary that uses Linux laptops. The Linux laptops do not have the posture agent installed, and the IT team is concerned that these devices will be unable to access the corporate SaaS applications. The firm's security policy requires all endpoints to meet the same posture requirements before accessing any corporate resource. The IT team has a limited budget and needs a solution that can be implemented quickly. Which approach best satisfies the security policy while accommodating the Linux laptops?

   • ABlock all Linux laptops from accessing corporate SaaS applications until a posture agent is available.
   • BRequire Linux users to access corporate SaaS applications through a virtual desktop infrastructure (VDI) environment that is managed and posture-checked.
   • CCreate a separate access policy for Linux laptops that only requires a valid user login and does not check posture.
   • DInstall a third-party posture-check agent on the Linux laptops that reports the same health attributes to the access gateway.
   Reveal Solution Discussion Select an answer first