Zero Trust Concept in Security Testing CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which statement best describes the core principle of 'never trust, always verify' in a Zero Trust model?

   • AEvery access request is treated as if it originates from an untrusted network until proven otherwise.
   • BDevices that are managed by the organization are automatically trusted.
   • CUsers are trusted once they have passed multi-factor authentication at the start of a session.
   • DTrust is granted based on the network location of the user's device.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security test engineer is designing test cases for a newly deployed Zero Trust architecture. The architecture enforces continuous authentication for every API call, regardless of the user's previous session. Which test case best validates that the control is working as intended?

   • AVerify that the API rejects requests from IP addresses outside the corporate network range.
   • BConfirm that the API returns a 401 status code when the user's role is changed mid-session.
   • CSend a series of API requests with a valid token and verify that each request is independently authenticated and authorized.
   • DIntercept an API request and replay it after the session token has expired to verify the request is rejected.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When assessing security testing activities against Zero Trust compliance requirements, what should a tester verify?

   • AThat access control policies are enforced consistently across all resources
   • BThat all users have administrative privileges to ensure smooth operations
   • CThat all data is encrypted at rest and in transit
   • DThat the network is isolated from the internet to prevent all attacks
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which testing technique is most appropriate for validating the effectiveness of micro-segmentation in a Zero Trust network?

   • AConducting a vulnerability scan on all external-facing servers
   • BPenetration testing from the internet to the internal network
   • CReviewing firewall logs for denied traffic
   • DAttempting lateral movement between segments after compromising one segment
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a key component of a Zero Trust architecture?

   • AA virtual private network (VPN) that encrypts all remote connections.
   • BIdentity and access management (IAM) that verifies users and devices before granting access.
   • CA demilitarized zone (DMZ) that separates the internal network from the internet.
   • DA firewall that blocks all inbound traffic from the internet.
   Reveal Solution Discussion Select an answer first