Zero Trust Fundamentals GDSA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security architect is designing access for a hospital's electronic health record (EHR) system. The requirement is that a nurse should only access patient records for patients currently under their care, and only during their shift. Which Zero Trust principle is most directly applied?

   • AData classification, tagging records by sensitivity level.
   • BMicro-segmentation, isolating the EHR system from other hospital systems.
   • CNever trust, always verify, requiring continuous authentication for every record view.
   • DLeast privilege access, granting the minimum permissions needed for the current task.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An organization is transitioning from a traditional perimeter model to Zero Trust. They have a large number of legacy applications that are accessed by employees from the office and remotely. The security team wants to minimize changes to the user experience. Which strategy is most effective?

   • ADeploy an identity-aware proxy in front of the applications and enforce access policies based on user and device context.
   • BRequire all users to connect through a VPN with MFA.
   • CMove all legacy applications to a new cloud platform and rewrite them with modern authentication.
   • DImplement micro-segmentation but keep the existing authentication mechanisms unchanged.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company is migrating its on-premises data center to a hybrid cloud model. Currently, any device connected to the corporate LAN is trusted and can reach internal file servers. The security team wants to adopt Zero Trust principles. Which change best aligns with the 'never trust, always verify' principle?

   • AImplement network segmentation so that only IT administrators can reach file servers from the LAN.
   • BKeep the current LAN trust model but add a VPN requirement for remote users.
   • CMove file servers to the cloud and rely on the cloud provider's perimeter security to protect them.
   • DRequire multi-factor authentication and device compliance checks for every access request to file servers, regardless of network location.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A network administrator is explaining to management why a Zero Trust model is more secure than the traditional 'trusted inside, untrusted outside' model. Which statement best captures the fundamental difference?

   • AZero Trust treats every request as potentially hostile, regardless of its source network location.
   • BZero Trust eliminates the need for firewalls and network segmentation.
   • CZero Trust replaces all passwords with biometric authentication.
   • DZero Trust focuses on protecting the network perimeter rather than individual resources.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company is replacing its legacy VPN-based remote access with a Zero Trust architecture. The security team wants to ensure that even if a user's laptop is compromised, the attacker cannot use that laptop to reach other internal systems. Which approach best meets this requirement?

   • ARequire users to connect through a jump host that has a hardened operating system and strict access controls.
   • BDeploy a next-generation firewall at the network perimeter and block all inbound traffic from the internet.
   • CImplement per-session, per-resource access decisions that verify the user, device posture, and request context before granting access to each application.
   • DMove all internal applications to a single VPN concentrator and require multi-factor authentication for every connection.
   Reveal Solution Discussion Select an answer first