Zero Trust Endpoints GDSA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A financial institution has a zero trust architecture that uses micro-segmentation to protect its trading application. The application consists of a web front-end, an application server, and a database. The security team wants to implement micro-segmentation to limit lateral movement, but the application has a legacy dependency: the application server must communicate with the database on a non-standard port, and the database must communicate with a third-party market-data feed on an external IP. The team is concerned that overly strict segmentation will break the application. Which approach best balances security and functionality?

   • APlace the web front-end, application server, and database on the same VLAN and rely on the host firewall to protect each server.
   • BCreate micro-segmentation rules that allow only the specific application flows (web-to-app, app-to-db on the non-standard port, and db-to-market-data on the external IP) and deny all other traffic.
   • CUse a traditional firewall to separate the application tiers into different subnets, but allow all traffic between the subnets.
   • DCreate a broad rule that allows all traffic between the application servers and the database, and a separate rule for the external market-data feed.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is implementing micro-segmentation for its server endpoints. The goal is to limit lateral movement if a web server is compromised. The security team has identified that the web server only needs to communicate with the application server on TCP 8080, and the application server only needs to communicate with the database server on TCP 1433. Which policy should be implemented?

   • AConfigure a VLAN for each server and route all traffic through a central firewall that allows any traffic between the VLANs.
   • BEnable network monitoring on each server to detect anomalous traffic patterns and alert the security team.
   • CCreate a distributed firewall rule that allows traffic only from the web server to the application server on port 8080, and from the application server to the database server on port 1433, blocking all other traffic between these tiers.
   • DPlace all three servers in the same subnet and rely on the existing network firewall to filter traffic based on source IP.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of using device identity in endpoint authentication?

   • ATo identify the physical location of the device
   • BTo determine the user's role in the organization
   • CTo verify that the device is authorized to access resources
   • DTo monitor the device's network traffic
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's zero trust policy engine detects that an endpoint is non-compliant because it is missing critical security patches. The endpoint is used by a senior executive who is about to give a critical presentation to a client. The access policy is set to 'deny' for non-compliant devices. The executive's assistant requests an exception. What is the most appropriate action for the security team?

   • AGrant a temporary, time-limited exception that allows access for the duration of the presentation, with enhanced monitoring and logging enabled.
   • BAllow the exception but do not log the activity to protect the executive's privacy.
   • CGrant the exception permanently to avoid future disruptions for the executive.
   • DDeny the exception and insist the executive uses a different, compliant device.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A retail company's security operations center (SOC) wants to detect endpoints that are beaconing to a known command-and-control (C2) domain. The company uses a security information and event management (SIEM) platform that ingests endpoint logs. Which data source and detection method would provide the most direct visibility?

   • ADNS query logs from the corporate DNS server, correlated with threat-intelligence feeds for known C2 domains.
   • BNetFlow data from the core switch, analyzed for unusual traffic volume during business hours.
   • CFirewall logs showing only allowed inbound connections from the internet.
   • DWindows Event Logs from domain controllers, filtered for failed logon attempts.
   Reveal Solution Discussion Select an answer first