Zero Trust Networking GDSA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security operations team is troubleshooting a zero trust network. They notice that a legitimate workload is being blocked by a microsegmentation policy, but the logs show that the traffic matches an allowed rule. The enforcement point is a next-generation firewall (NGFW). Which factor is most likely causing the block?

   • AThe workload's IP address has changed due to DHCP, but the policy is based on IP.
   • BThe traffic is encrypted and the NGFW cannot inspect it, so it blocks by default.
   • CThe NGFW is inspecting the traffic and the application signature does not match the allowed application ID.
   • DThe user's device posture is non-compliant, so the NGFW blocks the traffic.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary role of TLS in a Zero Trust architecture?

   • ATo encrypt data in transit between clients and servers, protecting it from eavesdropping and tampering
   • BTo provide a secure tunnel for all network traffic between sites
   • CTo authenticate users using digital certificates instead of passwords
   • DTo filter malicious traffic at the network perimeter
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the function of a policy enforcement point (PEP) in a Zero Trust architecture?

   • ATo generate alerts when a security incident is detected
   • BTo execute the access decision by allowing, denying, or limiting traffic based on policy
   • CTo make the final decision on whether to allow or deny a specific access request
   • DTo store and manage user credentials and certificates
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A government agency is deploying a Zero Trust network for its classified research environment. The architecture must ensure that a user's access to a document repository is granted only after verifying the user's clearance level, the security posture of their workstation, and the classification of the document. Which component should be placed in front of the document repository to enforce these decisions?

   • AA database that stores the document classification and requires a password for access.
   • BA network firewall that allows traffic from the research subnet to the repository subnet.
   • CA reverse proxy that terminates TLS and forwards requests to the repository without additional checks.
   • DA software-defined perimeter controller that authenticates the user, checks device posture, and establishes an encrypted session to the repository.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of continuous monitoring and analytics in a Zero Trust network?

   • ATo encrypt all data at rest and in transit automatically
   • BTo provide a historical record of all network traffic for compliance audits only
   • CTo detect anomalies and dynamically adjust access policies based on observed behavior
   • DTo replace the need for authentication by automatically blocking suspicious users
   Reveal Solution Discussion Select an answer first