Zero Trust Networking GDSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A university is implementing Zero Trust for its research network. The policy team wants to enforce access based on the researcher's identity, the security posture of their laptop, and the sensitivity of the data being accessed. Which component should make the final allow/deny decision?

   • AA directory service that authenticates the user and then trusts the laptop's self-reported posture without further checks.
   • BA network access control (NAC) server that checks the laptop's antivirus status and grants full network access if it is compliant.
   • CA firewall rule that allows traffic from the research subnet to the data storage subnet, regardless of user identity.
   • DA policy enforcement point that evaluates the identity, posture, and data classification attributes passed to it by the policy decision point.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A large enterprise is planning a Zero Trust network migration. The network team has identified that the legacy ERP system cannot support modern authentication protocols and relies on IP-based trust. The security team wants to enforce microsegmentation, but the ERP system must continue to function. Which approach is most appropriate?

   • AAllow all traffic to the ERP system from the internal network, and rely on the existing firewall rules.
   • BDeploy a policy enforcement point in front of the ERP system that translates the user's identity into a network-level allow, while gradually migrating the ERP to support modern authentication.
   • CMove the ERP system to a separate VLAN and restrict access based on source IP addresses.
   • DImmediately require the ERP system to support SAML or OAuth, and block all access until it is updated.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is migrating to zero trust networking. They have a legacy application that cannot support modern authentication protocols and relies on IP-based access control. The migration team wants to integrate this application into the zero trust architecture without exposing it to the broader network. Which approach should they take?

   • ADecommission the legacy application immediately and replace it with a modern one.
   • BPlace the legacy application behind a software-defined perimeter (SDP) controller that authenticates users and then proxies traffic to the application, while applying microsegmentation to limit which workloads can reach it.
   • CPut the legacy application on a separate VLAN with no additional controls.
   • DExpose the legacy application directly to the network and rely on its existing IP-based controls.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is implementing zero trust networking and wants to protect data in transit between users and applications. They have a mix of web-based applications and legacy client-server applications that do not support TLS. The security team wants to ensure that all traffic is encrypted without requiring changes to the legacy applications. Which approach should they use?

   • ADeploy a zero trust network access (ZTNA) solution that terminates TLS at the edge and proxies traffic to the legacy applications over an encrypted tunnel.
   • BRequire all users to connect via a VPN that encrypts traffic to the legacy applications.
   • CDisable encryption for legacy applications and rely on network segmentation.
   • DUse IPsec between the user's device and the legacy application server.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security architect is designing microsegmentation for a three-tier application (web, app, database). The web tier must be accessible from the internet, the app tier only from the web tier, and the database tier only from the app tier. The architect also wants to detect any attempt to bypass these rules. Which approach should they take?

   • APlace all three tiers on the same subnet and use host-based firewalls on each server.
   • BUse a traditional network segmentation with separate VLANs and a firewall between each VLAN, but do not log traffic.
   • CCreate a single rule that allows all traffic between the three tiers, and rely on the web application firewall (WAF) for protection.
   • DCreate microsegmentation policies that allow only the required paths, and enable logging on the enforcement points to capture any blocked traffic.
   Reveal Solution Discussion Select an answer first