What Is Zero Trust? CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security engineer is implementing Zero Trust for a multi-cloud environment. They need to ensure that a compromised workload in one cloud cannot access resources in another cloud. Which control is most effective?

   • AUsing a single cloud provider for all workloads to simplify security.
   • BPlacing all workloads in a single virtual network and using network ACLs.
   • CImplementing identity-based access policies that require mutual TLS between workloads and enforcing least privilege.
   • DRelying on the cloud provider's default network security groups.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is implementing Zero Trust and wants to enforce continuous verification. Which approach best achieves this?

   • AGranting access based on the user's role and location at the time of login.
   • BRe-authenticating users periodically and re-evaluating access policies based on real-time risk signals.
   • CRequiring multi-factor authentication only at the initial login.
   • DUsing a VPN that maintains a persistent connection for the entire session.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a Zero Trust architecture, what role does device security play?

   • AIt ensures that only devices that meet security policies (e.g., patched, compliant) can access resources.
   • BIt replaces the need for identity verification.
   • CIt focuses only on protecting servers, not end-user devices.
   • DIt is optional if the organization uses a strong firewall.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company currently relies on a firewall and VPN for remote access, granting full network access once a user authenticates. The security team wants to adopt a Zero Trust model. Which change best aligns with Zero Trust principles?

   • AIncrease firewall rules to block more ports and restrict inbound traffic from the internet.
   • BReplace the VPN with a solution that verifies user identity and device health for each application session, granting access only to specific resources.
   • CMove all applications to a public cloud and rely on the cloud provider's security controls.
   • DRequire multi-factor authentication for VPN access and keep the same network permissions.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is explaining Zero Trust to a new team member. Which statement best describes the core concept of Zero Trust?

   • ANo user or device is trusted by default, and every access request is verified before granting access.
   • BTrust is granted after a one-time authentication, and then access is allowed for the session.
   • CTrust is established based on the user's role and location, with access granted accordingly.
   • DTrust is based on the security of the network, so internal users are trusted more than external users.
   Reveal Solution Discussion Select an answer first