Zero Trust Networking GDSA Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A mid-sized company is adopting Zero Trust networking. The IT team has limited experience with microsegmentation and wants to avoid disrupting a legacy ERP system that is poorly documented. Which deployment approach is best?

   • AUse a third-party consultant to implement the entire Zero Trust architecture in a single engagement.
   • BStart with a pilot project on a non-critical application, document the traffic flows, then expand microsegmentation to other applications gradually.
   • CImmediately enable default-deny policies on the ERP system and rely on the firewall logs to identify needed flows.
   • DDeploy a new Zero Trust network segment and move all applications to it at once.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   An organization is deploying a zero trust network and needs to enforce policies at multiple points, including between workloads and at the user-to-application boundary. They also want to collect telemetry for continuous monitoring. Which set of components should they deploy?

   • AOnly a SIEM to collect logs from existing network devices.
   • BNext-generation firewalls (NGFWs) at segment boundaries and software-defined perimeter (SDP) controllers for user access, with logging enabled on both.
   • CA single traditional firewall at the internet edge with no internal segmentation.
   • DOnly a network tap on the core switch to monitor traffic.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A software company is building a zero trust architecture for its SaaS product. Customers access the product via a web browser, and the backend services communicate over the internet. The company wants to ensure that data in transit is protected and that the backend services can verify the identity of other services. Which combination should they use?

   • ATLS for both customer and service-to-service communication.
   • BIPsec VPN tunnels between all services and customers.
   • CTLS for customer-to-service communication and mutual TLS (mTLS) for service-to-service communication.
   • DmTLS for customer-to-service communication and TLS for service-to-service communication.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company is deploying zero trust networking for remote employees. They want to enforce access based on user identity, device posture, and location (e.g., country). They also want to ensure that all traffic is encrypted. Which policy enforcement point should they use?

   • AA traditional VPN gateway that authenticates users with a username and password.
   • BA firewall that only allows traffic from specific IP addresses.
   • CA cloud-based zero trust network access (ZTNA) proxy that evaluates identity, device posture, and geolocation, and enforces TLS.
   • DA network access control (NAC) solution that only checks if the device is domain-joined.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which of the following is an example of a policy enforcement point in a Zero Trust network?

   • AA certificate authority that issues TLS certificates
   • BA next-generation firewall that inspects and filters traffic between application tiers
   • CA SIEM platform that aggregates logs from various sources
   • DAn identity provider that authenticates users and issues tokens
   Reveal Solution Discussion Select an answer first