Zero Trust Networking GDSA Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the fundamental shift in security philosophy that defines Zero Trust Networking compared to traditional perimeter-based security?

   • ATrust is granted based on the user's identity and context rather than the network location of the device
   • BThe network perimeter is eliminated entirely and replaced with a single cloud-based security gateway
   • CAccess is granted only to devices that are physically located within the corporate office network
   • DAll traffic is encrypted at the network layer using IPsec tunnels between every pair of hosts
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A manufacturing company has deployed microsegmentation policies across its OT network. The security team wants to detect a compromised workstation that is attempting to communicate with a PLC on an unauthorized port. Which capability is most important to add?

   • AA SIEM that collects only authentication logs from the domain controllers.
   • BA packet capture device that records all traffic for 24 hours and stores it for forensic analysis.
   • CA vulnerability scanner that periodically checks the workstation for missing patches.
   • DContinuous flow logging from the policy enforcement points, fed into an analytics platform that alerts on policy violations.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A large organization is deploying zero trust networking across multiple data centers. They want to enforce consistent policies across all locations and have a centralized security team. They also need to support dynamic workloads that scale up and down. Which policy enforcement architecture should they choose?

   • AA single centralized firewall that all traffic must traverse.
   • BA software-defined networking (SDN) controller that only manages routing, not security policies.
   • CA centralized policy management platform that distributes policies to distributed enforcement points (e.g., virtual NGFWs and SDP controllers) in each data center.
   • DIndependent firewall rules configured manually at each data center.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security team is implementing zero trust networking and wants to use analytics to detect compromised workloads. They have deployed microsegmentation and are collecting flow logs from the enforcement points. Which analytics approach would best detect a workload that is attempting to communicate with a command-and-control (C2) server?

   • AReview logs only after a security incident is reported.
   • BBaseline the normal communication patterns of each workload and alert on deviations, such as new destinations or unusual protocols.
   • COnly alert on traffic that matches known malware signatures.
   • DUse a SIEM to correlate authentication logs with network logs, but only for user access, not workload traffic.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Why does Zero Trust Networking rely on identity-based access control rather than network location alone?

   • ABecause network location is only useful for blocking external threats, not internal ones
   • BBecause users often work from multiple locations and devices, making the network perimeter an unreliable trust boundary
   • CBecause IP addresses are encrypted and cannot be read by security tools
   • DBecause network location is difficult to determine in modern cloud environments
   Reveal Solution Discussion Select an answer first