Zero Trust Endpoints GDSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization is designing its zero trust endpoint trust assessment. They want to grant access to a sensitive application only if the endpoint is managed, has a valid certificate, and the user's behavior is not anomalous. Which combination of signals should be used to establish the endpoint's trust level?

   • ADevice compliance status from MDM, presence of a valid client certificate, and a user risk score from the identity provider.
   • BThe endpoint's operating system version and the user's department.
   • CThe time of day and the user's physical location.
   • DThe user's password strength and the endpoint's IP address.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A hospital allows clinicians to use personally owned tablets to access the electronic health record (EHR) system. The security team wants to ensure that only devices with a current OS patch level, a screen lock enabled, and no rooted/jailbroken status can reach the EHR. Which approach best meets these requirements?

   • AIntegrate the EHR's access gateway with a mobile device management (MDM) solution that reports device compliance attributes, and deny access when the device is non-compliant.
   • BRequire users to enter a one-time passcode (OTP) from an authenticator app on their tablet before accessing the EHR.
   • CDeploy a network access control (NAC) solution that checks the device's IP address and MAC address before granting VLAN access.
   • DConfigure the EHR to accept only connections from the hospital's guest Wi-Fi SSID, assuming the guest network is isolated from the internal network.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization is deploying a zero trust architecture for its clinical workstations. They need to ensure that only authorized, corporate-issued devices can request access to the electronic health record (EHR) system. The security team wants to prevent stolen or unauthorized devices from even attempting authentication. Which mechanism should be implemented to establish a strong device identity?

   • ARequire users to enter a complex password and a one-time code from a hardware token.
   • BRecord the MAC address of each workstation in the EHR application's allowlist.
   • CIssue each workstation a unique client certificate from an internal CA and require it during the TLS handshake with the EHR application.
   • DImplement a geofencing rule that only allows access from the hospital's IP address range.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of an endpoint health check?

   • AChecking the user's email address
   • BConfirming the endpoint's IP address is in a specific range
   • CReviewing the user's access history
   • DVerifying that the endpoint's antivirus definitions are up to date
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A zero trust architecture is being designed for a company that has a mix of corporate-owned and bring-your-own-device (BYOD) endpoints. The security team needs to establish a trust level for each device. Which approach best differentiates the trust level between these two types of devices?

   • ATrust level is based solely on the user's role, not the device type.
   • BCorporate-owned devices are assigned a higher trust level because they are managed and can be fully controlled, while BYOD devices are given a lower trust level and are subject to more restrictive access policies.
   • CBoth device types are given the same trust level because they are both endpoints.
   • DBYOD devices are given a higher trust level because they are owned by the user.
   Reveal Solution Discussion Select an answer first