Zero Trust Endpoints GDSA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An organization is implementing device authentication for its remote workforce. They are considering using certificate-based authentication (CBA) with a private CA. The security team is concerned about the scalability of managing certificates for thousands of devices. What is the most effective way to address this concern?

   • AUse a single shared certificate for all devices to simplify management.
   • BRely on the user's password for authentication and skip device certificates.
   • CImplement an automated certificate enrollment process using SCEP or EST, integrated with the MDM.
   • DManually issue certificates to each device during the onboarding process.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of continuous posture and health checks for endpoints in a zero trust architecture?

   • ATo reduce the need for user authentication
   • BTo ensure endpoints are always connected to the network
   • CTo verify that endpoints meet security policies before and during access
   • DTo monitor user behavior on the endpoint
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security operations center (SOC) analyst is investigating a potential incident involving a laptop that was reported stolen. The zero trust architecture has already revoked the device's certificate and blocked its access to corporate resources. What additional endpoint monitoring and visibility action should the SOC take to understand the potential impact?

   • ACheck the network firewall logs for any connections from the laptop's last known IP address.
   • BImmediately wipe the device remotely using the MDM to ensure all corporate data is erased.
   • CDisable the user's account in Active Directory to prevent any further authentication.
   • DReview the endpoint's telemetry logs from the EDR agent for any data exfiltration attempts or unusual file access patterns before the device was blocked.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization's zero trust policy engine dynamically adjusts access rights based on real-time risk signals. A user's endpoint is compliant, but the user is attempting to access a sensitive HR application from a new, unusual geographic location at an atypical time of day. The policy engine flags this as a risk. What is the most appropriate dynamic access control response?

   • AGrant full access because the endpoint is compliant and the user has valid credentials.
   • BDeny all access to the application until the user contacts the IT help desk to verify their identity.
   • CAllow access but require a step-up authentication challenge, such as a push notification to the user's registered mobile device.
   • DAllow access but only to a read-only view of the HR application for this session.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company's zero trust architecture uses automated remediation for non-compliant endpoints. When an endpoint fails a posture check (e.g., missing patch), the system automatically blocks access to corporate resources and sends a notification to the user. The company's security team wants to add a remediation workflow that allows the user to self-remediate the issue (e.g., install the patch) and regain access without IT intervention. Which approach best implements this workflow?

   • AConfigure the access gateway to re-evaluate the endpoint's posture after a short delay, and automatically grant access if the endpoint becomes compliant.
   • BAutomatically reimage the endpoint when it fails a posture check.
   • CProvide the user with a one-time bypass code that grants access for 24 hours, regardless of posture.
   • DRequire the user to submit a helpdesk ticket and wait for IT to manually re-enable access.
   Reveal Solution Discussion Select an answer first