Zero Trust Endpoints GDSA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A government agency issues smartcards to employees for accessing classified systems. The agency wants to ensure that the smartcard is bound to a specific, trusted endpoint and cannot be used from an unapproved device. Which additional control should be implemented?

   • ARequire the endpoint to present a device certificate that is validated by the access control system alongside the smartcard authentication.
   • BStore the smartcard's private key in the user's web browser profile.
   • CRequire the user to enter a PIN after inserting the smartcard into any computer.
   • DUse a software-based certificate store on the endpoint instead of the smartcard.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company's zero trust policy engine detects that an endpoint's antivirus definitions are out of date. The endpoint is currently accessing a low-risk file share. The security team wants to automatically remediate the issue without disrupting the user's work. What is the most appropriate automated response?

   • ASend an email to the user instructing them to manually update their antivirus definitions.
   • BTrigger a remediation workflow that pushes the latest antivirus definitions to the endpoint and re-evaluates its posture.
   • CRevoke the user's access to all applications until the endpoint is manually approved by the IT team.
   • DQuarantine the endpoint from the network immediately until the antivirus is updated.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary goal of micro-segmentation for endpoints?

   • ATo limit lateral movement by restricting communication between endpoints
   • BTo increase network speed by reducing the number of devices
   • CTo ensure all endpoints use the same security software
   • DTo provide a single point of entry for all endpoint traffic
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A large enterprise has a zero trust architecture that monitors endpoint activities using an EDR tool. The SOC receives an alert that a user's laptop is making repeated connections to an unusual external IP address at 3:00 AM. The user is not logged in at that time. The SOC investigates and finds that the laptop is running a scheduled task that was created by an unknown process. The laptop's posture check shows that the antivirus is up-to-date and the OS is fully patched. Which action should the SOC take first?

   • ADisable the scheduled task and allow the laptop to continue operating normally.
   • BReboot the laptop to clear any memory-resident malware and then reconnect it to the network.
   • CIgnore the alert because the laptop's posture check shows the antivirus is up-to-date and the OS is patched.
   • DIsolate the laptop from the network immediately and begin a forensic investigation of the scheduled task and the unknown process.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A cloud-based SaaS application is accessed by employees from both corporate laptops and personal phones. The security team wants to enforce a policy that grants full access from corporate laptops, but only read-only access from personal phones, and blocks access entirely if the phone is rooted. Which control should be used?

   • AUse a single sign-on (SSO) provider that authenticates the user and grants the same access level to all devices.
   • BBlock all access from personal phones and require employees to use only corporate laptops.
   • CConfigure the SaaS application's conditional access policy to evaluate device compliance and user location, and apply different access levels based on the results.
   • DRequire all employees to use a VPN before accessing the SaaS application, and rely on the VPN to enforce access levels.
   Reveal Solution Discussion Select an answer first