Zero Trust Endpoints GDSA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company's zero trust policy engine uses a risk score that combines user behavior, device posture, and data sensitivity. A user with a compliant device is accessing a low-sensitivity document repository. The user's behavior score drops because they are downloading an unusually large number of files. The policy engine must decide on an action. What is the most appropriate response that balances security and user productivity?

   • AImmediately revoke the user's access to all applications.
   • BBlock the download and require the user to re-authenticate with MFA.
   • CQuarantine the user's endpoint from the network for further investigation.
   • DAllow the download but trigger an alert to the security team for review.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A university allows students to access the library's online journal database from personal laptops. The IT department wants to grant access only when the device has an up-to-date antivirus and a non-admin user account. Which approach should the IT department take?

   • ARequire students to install a lightweight posture-check agent on their laptops that reports antivirus status and user account type to the access gateway.
   • BAsk students to self-certify that their antivirus is up-to-date and that they use a non-admin account before accessing the database.
   • CUse the device's IP address to determine if it is on the campus network, and allow access only from on-campus IPs.
   • DBlock all personal devices and require students to use only university-owned computers in the library.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is an example of endpoint context used in access control decisions?

   • AThe endpoint's current security posture
   • BThe user's birth date
   • CThe user's favorite color
   • DThe endpoint's serial number
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security analyst is investigating an alert from the EDR system. The alert indicates that a user's endpoint has been communicating with a known command-and-control (C2) server. The zero trust architecture has already isolated the endpoint. What is the most critical next step for the analyst to take to understand the scope of the compromise?

   • ADisconnect the endpoint from the network and power it off.
   • BChange the user's password to prevent further account compromise.
   • CReview the EDR timeline to identify the initial infection vector and the lateral movement attempts.
   • DImmediately reimage the endpoint to ensure the malware is removed.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A financial services firm issues managed laptops to employees. The security team wants to ensure that only the firm's own laptops can authenticate to the corporate VPN, even if a user's password is stolen. Which mechanism should be added to the VPN authentication flow?

   • AA one-time SMS passcode sent to the user's personal phone during VPN login.
   • BA shared secret key that is printed on a sticker attached to each laptop.
   • CA client certificate installed in the laptop's Trusted Platform Module (TPM) that is validated by the VPN gateway.
   • DA biometric fingerprint reader on the laptop that the user must scan before the VPN connects.
   Reveal Solution Discussion Select an answer first