Zero Trust Networking GDSA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A law firm is implementing Zero Trust networking. The security team wants to ensure that only partners can access the client document repository, and that access is only allowed from firm-managed laptops. The firm also requires that all access be logged for client confidentiality audits. Which combination of controls is most appropriate?

   • AA VPN that requires multi-factor authentication and then grants access to the entire internal network.
   • BAn SDP controller that authenticates the user, verifies the device is managed, and establishes an encrypted session to the repository, with all access logged.
   • CA firewall that allows traffic from the firm's office IP range to the repository's IP address.
   • DA shared folder on the network that is password-protected and accessible from any device on the LAN.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A large enterprise is migrating to Zero Trust networking. The network team is concerned about disrupting legacy applications that rely on direct IP communication. Management wants to see quick wins but also wants to minimize risk. Which deployment strategy is most appropriate?

   • ABig-bang migration: move all applications to a new Zero Trust network segment over a single weekend.
   • BImmediately replace all legacy firewalls with next-generation firewalls and enable strict default-deny policies.
   • CPhased migration: start with a pilot application, implement microsegmentation and identity-based policies, then expand incrementally.
   • DDeploy a new Zero Trust network in parallel and cut over all users at once after a single test.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A global enterprise is implementing zero trust networking. They have a mix of managed and unmanaged devices, and some users are contractors. The security team wants to grant access to a sensitive application only to managed devices with up-to-date antivirus and to users with multi-factor authentication (MFA) enabled. They also want to ensure that data in transit is encrypted. Which policy should they configure at the policy enforcement point?

   • ARequire user MFA only, and allow any device to connect.
   • BRequire device compliance only, and allow any user with valid credentials.
   • CRequire user MFA and device compliance, but do not enforce TLS.
   • DRequire device compliance (managed + AV up-to-date) AND user MFA, and enforce TLS for the session.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A hospital is deploying a new patient-records application. The security team wants to ensure that only the application server can talk to the database server, and only on the database port. They also want to enforce that only authenticated users with a compliant device can reach the application server. Which two controls should they implement together?

   • AA single firewall rule allowing all traffic from the app subnet to the database subnet, plus a VPN for remote users.
   • BNetwork segmentation at the VLAN level and a traditional stateful firewall at the internet edge.
   • CDatabase encryption at rest and a network intrusion detection system on the database segment.
   • DMicrosegmentation rules between the app and database tiers, plus an identity-aware policy enforcement point in front of the application.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A healthcare provider has deployed microsegmentation policies to restrict access to patient records. The security team is seeing an alert about a user who is accessing the records system from an unusual location, but the user's credentials are valid and the device posture is compliant. The team needs to determine whether this is a legitimate access or a potential compromise. Which action is most appropriate?

   • AImmediately block the user's access and require them to re-authenticate with multi-factor authentication.
   • BCorrelate the alert with other context, such as the user's normal access patterns, the time of day, and any recent authentication anomalies, before deciding to block access.
   • CIgnore the alert because the user's credentials are valid and the device is compliant.
   • DDisable the user's account and escalate to the incident response team.
   Reveal Solution Discussion Select an answer first