Zero Trust Fundamentals GDSA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A large enterprise is planning a Zero Trust rollout. The security team is concerned about user productivity because employees often need access to many applications throughout the day. Which implementation strategy best balances security with user experience?

   • AUse a single VPN for all remote access and rely on the corporate firewall for protection.
   • BRequire multi-factor authentication for every single access request, even within the same session.
   • CImplement single sign-on (SSO) with adaptive access policies that require step-up authentication only for high-risk requests.
   • DGrant all users access to all applications but monitor their activity for anomalies.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A mid-sized company is considering a full Zero Trust architecture. They currently have a flat network with legacy applications that do not support modern authentication protocols. The security team is concerned about the effort required to retrofit these applications. Which challenge is most directly highlighted by this situation?

   • AUser resistance to multi-factor authentication prompts
   • BPotential for increased latency due to per-request verification
   • CDifficulty in integrating legacy systems that lack support for modern authentication and authorization mechanisms
   • DIncreased complexity in managing identity and access policies across all resources
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A global company is implementing Zero Trust. They have a mix of managed and BYOD devices. The security team wants to enforce 'never trust, always verify' but is concerned about user privacy on BYOD devices. Which policy balances security and privacy?

   • ARequire all BYOD devices to be fully managed by the company's MDM, including the ability to wipe personal data.
   • BBlock all access from BYOD devices to any corporate resource.
   • CTreat BYOD devices the same as managed devices after a one-time registration.
   • DApply stricter access policies for BYOD devices, such as limiting access to sensitive data and requiring step-up authentication, while allowing full access only for managed devices.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is adopting Zero Trust and must choose between micro-segmentation and software-defined perimeter (SDP) for their data center. They have many legacy applications that do not support modern authentication protocols. Which approach is more feasible?

   • AMicro-segmentation, because it can protect legacy applications by controlling network traffic without requiring changes to the applications.
   • BNeither, because legacy applications cannot be secured in a Zero Trust model.
   • CSDP, because it can wrap legacy applications with an identity-aware proxy.
   • DBoth equally, because they are interchangeable.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company currently uses a traditional perimeter-based security model with a strong firewall and VPN. After a breach, they want to adopt Zero Trust. Which change is most aligned with Zero Trust principles?

   • AReplace the firewall with a more advanced next-generation firewall.
   • BMove all applications to the cloud and rely on the cloud provider's security.
   • CIncrease the frequency of vulnerability scans on internal servers.
   • DKeep the firewall but add micro-segmentation inside the network to limit lateral movement.
   Reveal Solution Discussion Select an answer first