Zero Trust Networking GDSA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational corporation is deploying a Zero Trust network. The security team wants to enforce that only users with a specific clearance level can access a sensitive application, and that the access is encrypted. The application is hosted in a private cloud, and users access it from both corporate and personal devices. Which policy enforcement point configuration is most appropriate?

   • AAn SDP controller that authenticates the user, checks the device posture, and establishes an encrypted session to the application, with the clearance level verified against the identity provider.
   • BA reverse proxy that requires a username and password and then forwards traffic to the application over HTTP.
   • CA VPN that requires multi-factor authentication and then grants access to the entire private cloud network.
   • DA firewall that allows traffic from the corporate IP range to the application's IP address.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services firm is replacing its legacy VPN with a Zero Trust network. Remote employees must access only the specific internal applications their role requires, and the connection must be encrypted. Which combination of controls should the architecture include?

   • AA load balancer that terminates TLS and forwards traffic to any backend server based on the destination IP address.
   • BA RADIUS server that authenticates the user and then assigns a static IP address from the internal network range.
   • CA software-defined perimeter controller that authenticates the user and device, checks posture, and establishes an encrypted tunnel to the allowed application.
   • DA next-generation firewall that allows all traffic from the corporate VPN pool to any internal application, with TLS inspection enabled.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A multi-tenant SaaS provider wants to ensure that tenants cannot access each other's backend databases. The databases are on the same network segment. The security team wants to enforce isolation at the network layer and also gain visibility into any cross-tenant traffic attempts. Which solution should they implement?

   • AA network intrusion detection system (NIDS) that monitors for suspicious traffic.
   • BA single firewall rule that allows all traffic between the application and database subnets.
   • CMicrosegmentation policies that allow each tenant's application servers to communicate only with their own database, with logging on the enforcement points.
   • DDatabase-level encryption and strong passwords.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which activity is an example of using network visibility and analytics to enforce Zero Trust policies?

   • AReviewing firewall logs once a month to identify potential misconfigurations
   • BEncrypting all traffic between two servers using TLS
   • CAutomatically blocking a user's access when their behavior deviates from an established baseline
   • DConfiguring a firewall to allow all traffic from a trusted IP range
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A healthcare organization is implementing Zero Trust microsegmentation between its patient portal and the electronic health record (EHR) system. The security team requires that the EHR system verify the identity of the patient portal before accepting any requests, and that all data in transit be encrypted. Which mechanism should be used?

   • AAn API key that the patient portal includes in each request, with the traffic sent over HTTP.
   • BStandard TLS, where the EHR system presents a server certificate and the patient portal verifies it.
   • CMutual TLS, where the patient portal presents a client certificate and the EHR system presents a server certificate.
   • DA shared secret embedded in the patient portal's configuration, with the traffic sent over a private VLAN.
   Reveal Solution Discussion Select an answer first