Zero Trust Fundamentals GDSA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security architect is designing a Zero Trust network for a research lab. The lab has a mix of managed and unmanaged devices (e.g., personal laptops of visiting researchers). The architect needs to allow these unmanaged devices to access a specific collaboration server while preventing access to sensitive research data. Which approach best meets this requirement?

   • ABlock all access from unmanaged devices to any internal resource
   • BRequire all unmanaged devices to be enrolled in the device management system before any access
   • CAllow unmanaged devices to access only the collaboration server, with strict conditional access policies that limit data exfiltration
   • DGrant unmanaged devices the same access as managed devices, but with additional monitoring
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security team is implementing Zero Trust for a cloud-native application. The application consists of multiple microservices that communicate with each other. The team wants to enforce least privilege and verify every service-to-service request. Which approach is most aligned with Zero Trust principles?

   • AImplement a service mesh with mutual TLS and fine-grained authorization policies for each service
   • BGrant each microservice a shared API key for authentication
   • CUse network policies that allow all traffic between microservices within the same namespace
   • DRely on the cloud provider's internal network to secure microservice communication
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An organization wants to implement Zero Trust for remote workers who access a specific set of cloud applications. They want to avoid exposing the applications to the public internet and want to enforce access based on user identity and device posture. Which deployment model best fits this requirement?

   • AMicro-segmentation of the corporate data center network.
   • BIdentity-based Zero Trust that relies solely on the identity provider for authentication.
   • CTraditional VPN with multi-factor authentication.
   • DSoftware-defined perimeter (SDP) that creates an overlay network and grants access only after device and user verification.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security architect is proposing a Zero Trust architecture to the board. The board is concerned about the cost and complexity of implementation. Which argument best justifies the investment?

   • AZero Trust reduces the blast radius of a breach, potentially lowering the financial impact of a security incident.
   • BZero Trust eliminates the need for any other security controls, reducing overall security spending.
   • CZero Trust is required by all industry regulations.
   • DZero Trust guarantees that no breach will ever occur.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company has a Zero Trust architecture that uses micro-segmentation. A new application needs to communicate with a database on a different segment. The security team is unsure which ports are required. What is the best approach to maintain Zero Trust while enabling the application?

   • AUse a temporary 'allow all' policy between the application and database segments, monitor traffic, and then create a specific allow rule based on observed flows.
   • BMove the application and database to the same segment to avoid segmentation.
   • CBlock all traffic until the application vendor provides the exact port list.
   • DPermanently allow all traffic between the two segments to ensure the application works.
   Reveal Solution Discussion Select an answer first