1.6 Explain the Concept of Zero Trust CYBERSECURITY-APPRENTICE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A network administrator is explaining the Zero Trust model to a colleague. The colleague argues that once a user successfully authenticates and is granted access to a resource, they should be trusted for the duration of their session. Which response best aligns with the Zero Trust philosophy?

   • AWe should trust the user but re-authenticate them periodically.
   • BWe should trust the user but monitor their activity for anomalies.
   • CTrust is never implicit; we must continuously verify the user's identity and device posture throughout the session.
   • DYou are correct; after authentication, the user is trusted for the session.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security administrator is implementing Zero Trust for a new application. They want to ensure that the application can only be accessed by users in the 'Finance' group, and that these users can only access the application during business hours. Which Zero Trust concept is the administrator primarily using to define these rules?

   • ALeast privilege access
   • BPolicy-based access control
   • CContinuous verification
   • DMicro-segmentation
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In the Zero Trust model, what is the default stance toward any user or device attempting to access resources?

   • ANo trust until verification is performed
   • BTrust after a one-time verification
   • CTrust based on the device's compliance status
   • DTrust if the user is on the corporate network
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security analyst is investigating a potential breach. They notice that a user's account, which normally accesses only the HR system, has been used to access the source code repository. The account's credentials were not compromised, and the user's device passed all compliance checks. Which Zero Trust control would be most effective in detecting and preventing this type of anomalous access?

   • AIncreasing the frequency of mandatory password changes.
   • BEnforcing least privilege access to the source code repository.
   • CUsing user and entity behavior analytics (UEBA) to detect anomalous access patterns.
   • DImplementing stricter password policies.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which principle is applied in Zero Trust to ensure users only have the access necessary to perform their job functions?

   • ALeast privilege access
   • BContinuous verification
   • CMicro-segmentation
   • DMaximum privilege access
   Reveal Solution Discussion Select an answer first