A large enterprise is planning a Zero Trust rollout. They have a mix of modern SaaS applications and legacy on-premises applications that cannot support modern authentication. The security team wants to enforce consistent identity-based access across all applications. Which approach best balances security and feasibility?

Isolate legacy applications on a separate network segment and treat them as untrusted

Deploy an identity-aware proxy in front of legacy applications to enforce authentication and authorization

Require all legacy applications to be rewritten to support modern authentication before proceeding

Deploy Zero Trust only for SaaS applications and leave legacy applications on the traditional perimeter model

How does Zero Trust differ from a traditional perimeter-based security model?

Zero Trust focuses on protecting the network, while traditional models focus on protecting data.

Zero Trust verifies every access request, while traditional models trust users and devices inside the network perimeter.

Zero Trust only applies to cloud environments, while traditional models are used for on-premises networks.

Zero Trust relies on a strong firewall at the network edge, while traditional models use multiple layers of security.

Which Zero Trust deployment model focuses on controlling access based on the identity of the user and device, rather than network location?

Software-defined perimeter (SDP)

What does Zero Trust imply about trust boundaries within a network?

Trust boundaries are moved to the network perimeter, where all traffic is inspected.

Trust boundaries are defined by physical security controls, such as locked server rooms.

Trust boundaries are eliminated; every request is verified regardless of its origin.

Trust boundaries are based on IP address ranges, with internal IPs trusted by default.

A company is evaluating the benefits of Zero Trust. They want to reduce the risk of data breaches caused by compromised credentials. Which benefit of Zero Trust is most directly related to this goal?

Simplification of the security architecture by removing all legacy systems

Guaranteed prevention of all phishing attacks

Elimination of the need for firewalls and network segmentation

Continuous verification of user identity and device posture for every access request

GIAC Defensible Security Architect

Domain 1Objective 1

Zero Trust Fundamentals GDSA Practice Questions (Page 5)

Part of the Zero Trust Architecture domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 21–25

21expert · hard
A large enterprise is planning a Zero Trust rollout. They have a mix of modern SaaS applications and legacy on-premises applications that cannot support modern authentication. The security team wants to enforce consistent identity-based access across all applications. Which approach best balances security and feasibility?
Select an answer first
22foundation · easy
How does Zero Trust differ from a traditional perimeter-based security model?
Select an answer first
23foundation · easy
Which Zero Trust deployment model focuses on controlling access based on the identity of the user and device, rather than network location?
Select an answer first
24foundation · easy
What does Zero Trust imply about trust boundaries within a network?
Select an answer first
25application · medium
A company is evaluating the benefits of Zero Trust. They want to reduce the risk of data breaches caused by compromised credentials. Which benefit of Zero Trust is most directly related to this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.