Zero Trust Endpoints GDSA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A defense contractor has a zero trust architecture that requires both user authentication and device authentication. The contractor issues laptops with TPM-bound certificates for device identity. A new requirement states that all access to classified systems must also require the user to be in a specific physical location (e.g., a secure facility). The contractor's identity provider (IdP) currently supports certificate-based device authentication and user multi-factor authentication (MFA). Which additional control should be implemented to meet the location requirement without weakening device identity?

   • AIntegrate the IdP with the facility's physical access control system (PACS) to verify the user's physical presence before granting access.
   • BRequire the user to enter a one-time passcode (OTP) generated by a hardware token that is only issued inside the facility.
   • CUse the laptop's IP address to determine if it is on the facility's network, and allow access only from that network.
   • DRequire the user to scan a QR code displayed on a monitor inside the facility before accessing classified systems.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In a zero trust architecture, what is the primary role of a zero trust endpoint?

   • ATo serve as a security enforcement point that is evaluated and granted access based on identity, health, and posture
   • BTo act as a trusted device that is automatically granted access based on its network location
   • CTo provide a secure baseline that allows all traffic from the endpoint to bypass inspection
   • DTo replace the need for user authentication by using device certificates alone
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is implementing micro-segmentation for its endpoints. The security team has created a policy that allows an endpoint to communicate only with the specific servers it needs. However, they are concerned about the operational overhead of maintaining these policies as the environment changes. What is the most effective way to manage this?

   • AUse a software-defined networking (SDN) controller that can dynamically update segmentation policies based on workload identity and application dependencies.
   • BDisable micro-segmentation and rely on the perimeter firewall for all traffic filtering.
   • CSegment endpoints into large groups based on department and apply the same policy to all endpoints in the group.
   • DCreate a static policy for each endpoint and manually update it when changes occur.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization is implementing device identity for its IoT sensors. These sensors are headless and cannot support a full EDR agent. The security team needs a way to authenticate these devices to the network and ensure they are not spoofed. Which approach is most suitable for establishing a strong device identity for these IoT sensors?

   • ARely on the sensor's MAC address for identification and allowlist it in the NAC policy.
   • BProvision each sensor with a unique certificate and use 802.1X for network authentication.
   • CAssign a static IP address to each sensor and use that for access control.
   • DRequire each sensor to authenticate with a username and password.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A manufacturing company's endpoint protection platform (EPP) detects that a machine on the factory floor has a known malware signature. The machine is running a critical production process that cannot be interrupted during the day. What is the most appropriate automated response?

   • AImmediately isolate the machine from the network and quarantine it until the malware is removed.
   • BQuarantine the malware file, block the specific C2 domain, and schedule a full scan during the next planned maintenance window.
   • CReboot the machine immediately to clear the malware from memory.
   • DIgnore the alert until the end of the shift, then manually investigate the machine.
   Reveal Solution Discussion Select an answer first