Zero Trust Concept in Security Testing CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of testing continuous authentication in a Zero Trust environment?

   • ATo test the strength of the password policy
   • BTo ensure that authentication is re-evaluated throughout the session based on risk signals
   • CTo confirm that multi-factor authentication is required for all users
   • DTo verify that users are authenticated only once at the start of a session
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During threat modeling for a Zero Trust architecture, the team is considering the risk of an insider threat. The architecture includes data loss prevention (DLP) and user behavior analytics (UBA). Which threat modeling approach best incorporates Zero Trust assumptions?

   • AAssume insiders are untrusted and model threats based on their access rights and behavior.
   • BAssume insiders are trusted because they have passed background checks.
   • CAssume insiders are only a risk if they have administrative privileges.
   • DAssume insiders cannot cause harm because DLP will block all data exfiltration.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is adopting Zero Trust and wants to update its security testing strategy. The CISO emphasizes that the strategy must reflect the principle of least privilege. Which testing approach best aligns with this principle?

   • ATest that administrators have full access to all systems to simplify management.
   • BTest that users have exactly the permissions required for their current role and no more.
   • CTest that users can access all resources they might need in the future to ensure availability.
   • DTest that all users have the same level of access to reduce complexity.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is implementing Zero Trust and has deployed a new identity provider (IdP) that integrates with all applications. As a security test engineer, you are asked to test the identity component. Which test is most relevant?

   • AVerify that data at rest is encrypted using AES-256.
   • BVerify that the network firewall blocks all inbound traffic from the internet.
   • CVerify that the IdP correctly authenticates users and issues tokens with appropriate claims.
   • DVerify that all devices have the latest antivirus software installed.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Zero Trust architecture includes a data security component that encrypts data at rest and in transit. As a security test engineer, you are asked to test the data security controls. Which test is most relevant?

   • AVerify that the network firewall blocks all inbound traffic.
   • BVerify that users are authenticated using MFA.
   • CVerify that devices are compliant with security policies.
   • DVerify that data is encrypted when stored in the database.
   Reveal Solution Discussion Select an answer first