Zero Trust Networking GDSA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In a Zero Trust architecture, what factors are used to make an access decision for a user requesting access to an application?

   • AThe user's role and the IP address of the application server
   • BThe user's identity, device posture, and contextual signals such as location and time
   • CThe user's password and the network segment from which the request originates
   • DThe user's biometric data and the physical location of the data center
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why is it important to integrate Zero Trust Networking with existing infrastructure during deployment?

   • ATo guarantee that all traffic is encrypted without additional configuration
   • BTo ensure that legacy applications continue to function while security is gradually improved
   • CTo eliminate the need for ongoing monitoring and analytics
   • DTo allow the organization to remove all firewalls and rely solely on identity
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A financial firm has deployed microsegmentation policies to restrict communication between its trading and settlement systems. The security team wants to detect an insider who is using a compromised account to access the settlement system from the trading system. Which monitoring capability is most effective?

   • AChecking the settlement system's application logs for failed login attempts.
   • BMonitoring the physical security cameras in the data center.
   • CReviewing firewall deny logs to see which traffic was blocked by the microsegmentation rules.
   • DAnalyzing flow logs from the policy enforcement points to identify traffic that matches the microsegmentation policy but originates from an unexpected user context.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A technology company is implementing Zero Trust microsegmentation between its microservices. The security team wants to ensure that only the order service can call the payment service, and that the communication is encrypted. The operations team is concerned about the performance overhead of encrypting every internal call. Which approach best balances security and performance?

   • AEncrypt only the traffic that crosses network boundaries, and leave internal service-to-service traffic unencrypted.
   • BAllow unencrypted HTTP traffic between services on a private network, and rely on the network segmentation to protect the data.
   • CUse standard TLS with a shared certificate for all internal services, and rely on network policies to restrict access.
   • DImplement mutual TLS between the order and payment services, and use a service mesh to manage the certificates and policies centrally.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is reviewing logs from a zero trust network and notices that a workload is attempting to communicate with an IP address outside its allowed microsegmentation policy. The policy enforcement point is configured to block the traffic, but the analyst wants to ensure this behavior is detected and responded to automatically. What should they configure?

   • AA manual process where the analyst checks logs weekly.
   • BAn alerting rule in the security analytics platform that triggers when the enforcement point logs blocked traffic to unexpected destinations.
   • CA network tap that captures all traffic and stores it for forensic analysis.
   • DA firewall rule that allows the traffic and logs it for later review.
   Reveal Solution Discussion Select an answer first