An organization is implementing continuous posture checks for endpoints. The security team is debating between using an agent-based approach (EDR/MDM) and an agentless approach (NAC/network scan). The environment includes a mix of corporate laptops and unmanaged contractor devices. The requirement is to enforce posture checks on all devices before granting access to the internal network. What is the most significant trade-off to consider?

Agent-based checks provide deeper visibility and control but require installation and management, which is not feasible for unmanaged contractor devices.

Agentless checks are always more secure because they do not require software installation.

Agent-based checks are only useful for Windows devices and cannot be used for other operating systems.

Agentless checks provide the same level of endpoint health data as agent-based checks.

A company's endpoint protection platform (EPP) detects that a laptop has a fileless malware infection that is executing in memory. The laptop is currently connected to the corporate network and the user is actively working. What is the most appropriate immediate response?

Disable the user's account and require them to use a different laptop.

Reboot the laptop to clear memory, then reconnect it to the network.

Isolate the laptop from the network and terminate the malicious process, then run a full scan.

Allow the user to continue working and schedule a scan for the end of the day.

A company's zero trust policy requires continuous posture checking for all endpoints. An endpoint is found to be non-compliant because a critical security agent is not running. The policy engine is configured to restrict access. What is the most effective way to enforce this policy?

Allow access but log the non-compliance for the next security audit.

Block all network traffic from the endpoint at the switch port.

Revoke the user's access to all applications permanently.

Use the MDM to force a reinstall of the security agent and then re-evaluate the endpoint's posture.

What is a key characteristic of dynamic access control policies for endpoints?

They are based solely on the user's role

They are applied only once at the time of login

They are based on static rules that never change

They adapt based on real-time endpoint context and user behavior

Why is endpoint monitoring important in a zero trust architecture?

To detect anomalies and potential threats in real time

To ensure endpoints are always online

To automate user password resets

To reduce the need for endpoint encryption

GIAC Defensible Security Architect

Domain 1Objective 2

Zero Trust Endpoints GDSA Practice Questions (Page 4)

Part of the Zero Trust Architecture domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 4–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

8concepts

Questions 16–20

16expert · hard
An organization is implementing continuous posture checks for endpoints. The security team is debating between using an agent-based approach (EDR/MDM) and an agentless approach (NAC/network scan). The environment includes a mix of corporate laptops and unmanaged contractor devices. The requirement is to enforce posture checks on all devices before granting access to the internal network. What is the most significant trade-off to consider?
Select an answer first
17application · medium
A company's endpoint protection platform (EPP) detects that a laptop has a fileless malware infection that is executing in memory. The laptop is currently connected to the corporate network and the user is actively working. What is the most appropriate immediate response?
Select an answer first
18application · medium
A company's zero trust policy requires continuous posture checking for all endpoints. An endpoint is found to be non-compliant because a critical security agent is not running. The policy engine is configured to restrict access. What is the most effective way to enforce this policy?
Select an answer first
19foundation · easy
What is a key characteristic of dynamic access control policies for endpoints?
Select an answer first
20foundation · easy
Why is endpoint monitoring important in a zero trust architecture?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.