An organization is building a Zero Trust architecture and wants to ensure that access decisions consider the user's role, the device's compliance status, and the sensitivity of the data being accessed. Which set of components must work together to achieve this?

DNS, DHCP, and network access control (NAC).

Firewall, VPN concentrator, and load balancer.

SIEM, log aggregator, and ticketing system.

Identity provider, device management (MDM), and data classification system.

A security architect is designing a Zero Trust architecture for a multi-cloud environment. The requirement is to enforce consistent access policies regardless of which cloud provider hosts the application. Which component is essential?

A network firewall that spans all cloud providers.

Separate identity stores for each cloud provider to avoid vendor lock-in.

A data loss prevention tool that works across all cloud providers.

A centralized identity provider that integrates with all cloud applications and supports standards like SAML or OIDC.

Which of the following is a common benefit of implementing a Zero Trust architecture?

Reduced risk of lateral movement by attackers who have compromised an internal device.

Simplification of network architecture by removing all internal security controls.

Elimination of the need for user authentication for internal applications.

Guaranteed prevention of all cyberattacks.

A company wants to implement Zero Trust for a legacy data center. They have limited budget and cannot replace existing network infrastructure. They need to reduce lateral movement and enforce access control. Which deployment model is most feasible given these constraints?

Full software-defined perimeter requiring new network appliances

Identity-based access only, without network segmentation

Migrate all applications to the cloud to enable Zero Trust

Micro-segmentation using existing VLANs and firewall rules

A company currently uses a traditional perimeter-based security model. An attacker has compromised a single workstation on the internal network. In a Zero Trust architecture, which additional control would most effectively limit the attacker's ability to move laterally to other systems?

Implementing micro-segmentation with per-application access policies

Increasing the frequency of vulnerability scans

Deploying a next-generation firewall at the internet edge

Enabling stronger password policies for all users

GIAC Defensible Security Architect

Domain 1Objective 1

Zero Trust Fundamentals GDSA Practice Questions (Page 6)

Part of the Zero Trust Architecture domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 26–30

26application · medium
An organization is building a Zero Trust architecture and wants to ensure that access decisions consider the user's role, the device's compliance status, and the sensitivity of the data being accessed. Which set of components must work together to achieve this?
Select an answer first
27expert · hard
A security architect is designing a Zero Trust architecture for a multi-cloud environment. The requirement is to enforce consistent access policies regardless of which cloud provider hosts the application. Which component is essential?
Select an answer first
28foundation · easy
Which of the following is a common benefit of implementing a Zero Trust architecture?
Select an answer first
29expert · hard
A company wants to implement Zero Trust for a legacy data center. They have limited budget and cannot replace existing network infrastructure. They need to reduce lateral movement and enforce access control. Which deployment model is most feasible given these constraints?
Select an answer first
30application · medium
A company currently uses a traditional perimeter-based security model. An attacker has compromised a single workstation on the internal network. In a Zero Trust architecture, which additional control would most effectively limit the attacker's ability to move laterally to other systems?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.