Zero Trust Fundamentals GDSA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security architect is designing a Zero Trust architecture for a hybrid environment. The company uses Active Directory on-premises and Azure AD in the cloud. They want to ensure that user identities are consistently verified across both environments. Which approach is most effective?

   • ASynchronize on-premises identities to Azure AD and use Azure AD as the single identity provider for all access decisions
   • BMaintain separate identity stores and manually map users between them
   • CUse a federation trust between AD and Azure AD, but keep separate policy engines
   • DRely on each environment's native authentication and do not integrate them
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a key component of a Zero Trust architecture?

   • AIdentity and access management (IAM) that verifies users and devices before granting access.
   • BA single firewall at the network perimeter that blocks all external threats.
   • CA demilitarized zone (DMZ) that separates the internal network from the internet.
   • DA virtual private network (VPN) that provides secure remote access to the internal network.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a common challenge when implementing a Zero Trust architecture in an existing enterprise environment?

   • AZero Trust eliminates the need for security monitoring, reducing operational overhead.
   • BIntegrating Zero Trust controls with legacy systems that were not designed for granular access policies.
   • CZero Trust is only applicable to cloud environments, so on-premises systems cannot be protected.
   • DThe architecture requires a complete replacement of all existing hardware and software.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is considering a Zero Trust architecture but is concerned about the operational overhead of continuous verification. They have a large number of IoT devices that generate low-risk telemetry data. The security team wants to apply Zero Trust without overwhelming the network with authentication traffic. Which approach best balances security and performance?

   • AApply risk-based conditional access, with stricter verification for high-risk devices and lighter checks for low-risk IoT telemetry
   • BExempt IoT devices from all verification to reduce overhead
   • CUse a separate network for IoT devices and apply traditional perimeter controls
   • DApply continuous verification to all devices, including IoT, to ensure maximum security
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization is implementing Zero Trust and wants to ensure that a user's access to a sensitive database is continuously validated, not just at login. Which combination of controls best supports this requirement?

   • ANetwork segmentation that limits database access to specific IP ranges
   • BSession timeout and re-authentication after inactivity
   • CConditional access policies that evaluate risk signals in real time and can block access if the user's device becomes non-compliant
   • DA strong password policy and mandatory multi-factor authentication at initial login
   Reveal Solution Discussion Select an answer first