Zero Trust Networking GDSA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A financial services firm is implementing zero trust networking for its internal microservices. The services communicate over HTTP on an internal network. The security team wants to ensure that only authenticated services can call each other and that the traffic is protected from eavesdropping. Which approach should they choose?

   • AUse a VPN tunnel between all services.
   • BEnable mutual TLS (mTLS) between services with certificates issued to each service identity.
   • CUse standard TLS with server-side certificates only.
   • DImplement IP-based allowlists on each service's firewall.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company is redesigning its network to adopt Zero Trust principles. The security team wants to ensure that a user's access to an internal application is not automatically trusted just because the user is on the corporate network. Which policy change is most aligned with Zero Trust?

   • ARequire multi-factor authentication only for users accessing the application from outside the corporate network.
   • BRequire the user to authenticate and have their device posture checked before accessing the application, regardless of their network location.
   • CAllow all users on the corporate network to access the application without additional authentication.
   • DUse a firewall to block access to the application from external IP addresses only.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A hospital is deploying a Zero Trust network. The compliance team requires that only the cardiology department's workstations can reach the cardiology EHR application, and only during scheduled shifts. The network team wants to avoid creating separate VLANs for every department. Which approach best meets the requirement?

   • ADeploy a next-generation firewall at the internet edge and allow all internal traffic to flow freely to the EHR application.
   • BConfigure the EHR application to require a VPN connection from any internal user, then rely on the VPN's authentication logs for compliance.
   • CPlace the cardiology EHR on a separate VLAN and restrict access using an ACL that permits only the cardiology department's subnet.
   • DCreate a microsegmentation policy that combines user identity, device posture, and time-of-day to allow access to the cardiology EHR from approved workstations.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company is redesigning its network security architecture. The CISO wants to move away from the traditional model where being on the internal network implies trust. Instead, they want every access request to be authenticated, authorized, and encrypted, regardless of the user's location. Which architecture change best aligns with this goal?

   • ACreate a DMZ for all internal applications and require users to access them through a jump host.
   • BDeploy an identity-aware proxy that enforces access policies per request, with all traffic encrypted via TLS.
   • CStrengthen the perimeter firewall and require VPN for all remote access.
   • DImplement a NAC solution that only checks if devices are domain-joined.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company is evaluating zero trust networking solutions. They have a requirement that all access decisions must consider the user's role, the device's compliance status, and the sensitivity of the data being accessed. They also want to avoid a single point of failure in the enforcement path. Which architecture best meets these requirements?

   • AA network architecture that relies on IP-based access control lists (ACLs) on routers.
   • BA distributed set of policy enforcement points that query a central policy engine for each access request, with redundant paths to avoid a single point of failure.
   • CA single policy enforcement point that makes all decisions and is the only path to applications.
   • DA solution that only uses device certificates for authentication, without considering user role or data sensitivity.
   Reveal Solution Discussion Select an answer first