Zero Trust Networking GDSA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which statement best describes the core principle of 'never trust, always verify' in Zero Trust Networking?

   • AAll network traffic must be encrypted with at least TLS 1.3 to be considered secure
   • BUsers must re-authenticate for every single packet they send across the network
   • CThe network is divided into multiple isolated segments, each with its own firewall
   • DNo user or device is trusted by default, even if it is already inside the network perimeter
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is moving from a traditional perimeter firewall to a zero trust model. Employees work from home and from the office. The security team wants to enforce access to internal applications based on user identity and device compliance, regardless of location. Which architecture should they implement?

   • AA network access control (NAC) solution that only checks if the device is on the corporate network.
   • BAn identity-aware proxy that evaluates user, device posture, and context before allowing access to each application.
   • CA demilitarized zone (DMZ) with a reverse proxy that only checks the user's IP address.
   • DA site-to-site VPN for all remote users, with the same firewall rules as the office.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A global bank is implementing microsegmentation across its data center. The security team wants to enforce that only the payment processing service can access the customer database, and only from the production environment. However, the development team needs to run integration tests against a copy of the database in a staging environment. The bank's compliance team requires that all access to customer data be logged and auditable. Which approach best balances these requirements?

   • ABlock all access to the customer database except from the payment service, and require developers to test against synthetic data in a separate environment.
   • BCreate separate microsegmentation policies for production and staging, allowing the payment service in production and the test service in staging to access their respective database copies, with logging enabled on both.
   • CAllow the payment service and the test service to access the same production database, but require the test service to use a read-only account.
   • DUse a single policy that allows both the payment service and the test service to access the database, but rely on the database's own audit logs.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A retail company is implementing Zero Trust microsegmentation between its web front-end and backend database. The security team requires that only the front-end service can communicate with the database, and that the communication be protected from eavesdropping and tampering. Which control should be implemented?

   • AA database-level password that the front-end uses to log in, with the database bound to a private IP address.
   • BAn IPsec tunnel between the two servers, with the database firewall allowing traffic from any internal host.
   • CMutual TLS between the front-end and database, with a network policy that allows only the front-end service account to connect to the database port.
   • DA VLAN that separates the front-end and database, with a firewall rule permitting all traffic from the front-end subnet to the database.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A large enterprise with a legacy data center wants to migrate to zero trust networking without causing downtime. The network team has limited staff and cannot replace all infrastructure at once. Which deployment strategy should they adopt?

   • ABig-bang replacement of all network infrastructure over a weekend.
   • BDeploy a new parallel network and cut over all traffic at once after testing.
   • CPhased migration, starting with the most critical applications and gradually expanding microsegmentation.
   • DDisable all legacy network controls and rely solely on identity-based policies.
   Reveal Solution Discussion Select an answer first