2.1 Describe Key Characteristics of Zero Trust Network Access (ZTNA) CYBERSECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is experiencing performance issues with their remote access solution. Users report that the VPN is slow and often drops connections. The IT team is considering a move to ZTNA. They have a requirement to support a large number of concurrent users and need to ensure high availability. What is a key architectural advantage of ZTNA over a traditional VPN that can help address these performance and scalability concerns?

   • AZTNA requires less bandwidth than a VPN because it only sends the application data, not the entire network traffic.
   • BZTNA brokers can be deployed in a distributed, multi-cloud architecture, allowing for horizontal scaling and load balancing across multiple points of presence.
   • CZTNA uses a more efficient encryption algorithm than VPN, which reduces the CPU load on the user's device.
   • DZTNA eliminates the need for a VPN concentrator, which is the main bottleneck in traditional VPN architectures.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security architect is designing a ZTNA solution for a company that has a strict data residency requirement. All application data must remain within a specific geographic region. The company is considering using a global cloud-based ZTNA provider. What is the most important architectural consideration to ensure compliance?

   • AEnsure that the application itself is hosted in the required region, as this is the only factor that matters.
   • BUse a VPN instead of ZTNA, as VPNs are always compliant with data residency requirements.
   • CEnsure that the user's device is located in the same geographic region as the application.
   • DEnsure that the ZTNA broker and policy engine can be deployed in a region that is within the required geographic boundary, and that data does not transit through other regions.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a security benefit of ZTNA?

   • AIt provides a direct connection to the corporate network for all users.
   • BIt allows all users to access all applications for easier collaboration.
   • CIt eliminates the need for user authentication.
   • DIt reduces the attack surface by hiding applications from unauthorized users.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is setting up a ZTNA solution. They have integrated their identity provider (IdP) with the ZTNA broker. What is the primary role of the identity provider in this architecture?

   • ATo make the final decision on whether to grant or deny access to an application.
   • BTo establish the secure connection between the user and the application.
   • CTo monitor user activity and log all access attempts.
   • DTo authenticate the user and provide identity information, such as group memberships, to the policy engine.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company currently uses a traditional VPN to provide remote employees access to the corporate network. The security team is concerned that once a user authenticates to the VPN, they can reach the entire internal subnet, including legacy servers that should not be accessible. They want to implement a solution that limits access to only the specific applications each user is authorized to use, while also providing visibility into which applications are actually being accessed. Which approach best meets these requirements?

   • AMove all applications to the public internet and rely on their built-in authentication mechanisms.
   • BImplement multi-factor authentication (MFA) on the existing VPN to strengthen the initial authentication step.
   • CDeploy a ZTNA solution that brokers access per application based on identity and policy, and logs all application sessions.
   • DKeep the VPN but segment the internal network into smaller subnets and assign users to different subnets based on their role.
   Reveal Solution Discussion Select an answer first