Zero-Trust Security JN0-1103 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of micro-segmentation in a zero-trust implementation?

   • ATo increase the speed of network traffic by reducing routing hops
   • BTo provide a single sign-on experience for all applications
   • CTo isolate workloads and limit lateral movement within the network
   • DTo replace the need for encryption on all network traffic
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A university is implementing zero-trust for its student portal. The portal hosts grades, registration, and financial aid. The security team wants to ensure that a student accessing grades cannot also access financial aid records unless explicitly authorized. Which principle is most directly applied?

   • ANetwork segmentation, placing grades and financial aid on different subnets.
   • BMulti-factor authentication, requiring a second factor for every portal login.
   • CLeast privilege access, granting each student only the permissions needed for their specific role and tasks.
   • DContinuous monitoring, logging all student activity for later analysis.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large enterprise is implementing zero-trust. The security team must balance the need for granular micro-segmentation with the operational overhead of managing many security policies. They also need to ensure that critical applications remain highly available. Which approach best balances security and operational efficiency?

   • AUse a single flat network and rely on host-based firewalls for all security.
   • BDeploy micro-segmentation only for internet-facing applications and leave internal applications unsegmented.
   • CImplement micro-segmentation at the application tier, grouping workloads with similar security requirements into a few well-defined segments.
   • DCreate a unique segment for every individual workload to maximize isolation.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial firm is designing a zero-trust architecture for remote employees accessing internal applications. The CISO mandates that access decisions must consider user identity, device compliance, and real-time risk signals. Which component is essential to enforce these dynamic policies at the point of access?

   • AA network access control list that restricts traffic based on source IP addresses.
   • BA firewall that inspects traffic between the remote user and the application.
   • CA VPN concentrator that authenticates the user and encrypts the tunnel.
   • DA policy enforcement point that evaluates identity, device posture, and contextual risk before granting access.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A hospital network historically allowed any authenticated staff device to reach the pharmacy management system. After a ransomware incident traced to a compromised nurse's laptop, the security team must prevent lateral movement while keeping legitimate pharmacy staff productive. Which approach best aligns with zero-trust principles?

   • AMove the pharmacy system to a public cloud and require all staff to connect through a VPN.
   • BPlace the pharmacy system on a separate VLAN and allow only pharmacy staff IP addresses through the firewall.
   • CImplement micro-segmentation with per-session authentication and device posture checks before allowing access to the pharmacy system.
   • DRequire multi-factor authentication for pharmacy staff and add an intrusion prevention system in front of the pharmacy system.
   Reveal Solution Discussion Select an answer first